forgejo: serve dev.jinemi.com alongside git.thermograph.org
Both hostnames go on a single Caddy site block. That is load-bearing rather than cosmetic: the /v2/* mesh-only matcher that keeps the OCI registry API off the public internet (hazard #15) is scoped per block, so a separate block for the new name would serve the same Forgejo with the registry open. git.thermograph.org stays canonical — Forgejo has one ROOT_URL and builds every absolute URL from it, so clone URLs, the OAuth callback and post-login redirects keep naming the .org host. Flipping FORGEJO_DOMAIN additionally requires the Google OAuth redirect URI, the registry host baked into image names and runner labels, and the mesh /etc/hosts pins; README documents those prerequisites. Config verified with `caddy validate` and by asserting against the adapted JSON that the /v2 403 guard matches both hostnames.
This commit is contained in:
Emi Griffith
parent
001e6b1365
commit
396b80cf91
5 changed files with 77 additions and 14 deletions
|
|
@ -26,7 +26,7 @@ rather than which environment happens to live there:
|
|||
|
||||
| Host | Public IP | Mesh IP | Role |
|
||||
|------|-----------|---------|------|
|
||||
| **vps1** | `75.119.132.91` | `10.10.0.2` | "Operational programs": Forgejo (git + CI + registry, `git.thermograph.org`), Grafana/Loki/Alloy (`dashboard.thermograph.org`), the `emigriffith.dev` portfolio, and the **dev** environment (mesh-only, `10.10.0.2:8137`, no public DNS/Caddy/TLS) |
|
||||
| **vps1** | `75.119.132.91` | `10.10.0.2` | "Operational programs": Forgejo (git + CI + registry, `git.thermograph.org`, also served at `dev.jinemi.com` — migration in progress, `.org` still canonical), Grafana/Loki/Alloy (`dashboard.thermograph.org`), the `emigriffith.dev` portfolio, and the **dev** environment (mesh-only, `10.10.0.2:8137`, no public DNS/Caddy/TLS) |
|
||||
| **vps2** | `169.58.46.181` | `10.10.0.1` | "The deployed environment": **prod** and **beta**, as two separate Docker Swarm stacks, plus Centralis, Postfix, the backups, and the one shared TimescaleDB instance both stacks use |
|
||||
| **desktop** | — | `10.10.0.3` | AI-model hosting (voice-to-text, an upcoming-feature LLM) plus flex Swarm-worker capacity. Hosts **no** Thermograph environment — `make dev-up` still works there, but only as a laptop-local rehearsal |
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,9 @@ Two VPS boxes plus the operator's desktop, on one WireGuard mesh, named by
|
|||
ROLE rather than by environment:
|
||||
|
||||
- **vps1** — `75.119.132.91`, mesh `10.10.0.2`. "Operational programs": Forgejo
|
||||
(git + CI + registry, `git.thermograph.org`), Grafana/Loki/Alloy
|
||||
(git + CI + registry, `git.thermograph.org`, also served at `dev.jinemi.com`
|
||||
— one Caddy site block, the `.org` name still canonical; migration in
|
||||
progress, see `deploy/forgejo/README.md`), Grafana/Loki/Alloy
|
||||
(`dashboard.thermograph.org`), the `emigriffith.dev` portfolio site, and the
|
||||
**dev** environment (`/opt/thermograph-dev`, tracks `dev`), with its own
|
||||
Postgres container. Dev is mesh-only here — published on `10.10.0.2:8137`,
|
||||
|
|
|
|||
|
|
@ -3,6 +3,9 @@
|
|||
# vps1 serves:
|
||||
# emigriffith.dev -> static portfolio site (from disk)
|
||||
# git.thermograph.org -> Forgejo (see deploy/forgejo/caddy-git.conf)
|
||||
# dev.jinemi.com -> Forgejo, same site block — migration target for
|
||||
# git.thermograph.org, both served, the .org one
|
||||
# still canonical (that file's header explains)
|
||||
# dashboard.thermograph.org -> Grafana (see observability/caddy-grafana.conf)
|
||||
#
|
||||
# and hosts the **dev** environment at dev.thermograph.org (below).
|
||||
|
|
|
|||
|
|
@ -83,6 +83,53 @@ pattern as its other site blocks, same automatic-HTTPS.
|
|||
reach the registry over the mesh, not the public internet — see "Registry
|
||||
access from mesh clients" below.
|
||||
|
||||
## Migrating the domain (git.thermograph.org -> dev.jinemi.com)
|
||||
|
||||
In progress. **Both hostnames are served**; `git.thermograph.org` is still the
|
||||
canonical one.
|
||||
|
||||
`caddy-git.conf` lists both names on a *single* site block. That is deliberate,
|
||||
not cosmetic: the `/v2/*` mesh-only matcher is per-block, so a second block for
|
||||
`dev.jinemi.com` would re-expose the registry API publicly and undo hazard #15.
|
||||
Whatever else changes, keep the two names in one block.
|
||||
|
||||
Serving a second hostname is the cheap half. Forgejo has exactly one
|
||||
`ROOT_URL`, and it builds every absolute URL from it, so on the non-canonical
|
||||
host today:
|
||||
|
||||
- clone URLs on repo pages read `git.thermograph.org`,
|
||||
- the OAuth callback and post-login redirect land on `git.thermograph.org`
|
||||
(login is Google-SSO-only — see `docker-stack.yml`),
|
||||
- webhook payload URLs and notification mail links use `git.thermograph.org`.
|
||||
|
||||
Browsing, git-over-HTTP and the API all work on `dev.jinemi.com` regardless.
|
||||
|
||||
Flipping canonical (`FORGEJO_DOMAIN=dev.jinemi.com`, then `docker stack deploy`)
|
||||
needs these **first**, or it breaks login and CI rather than just renaming
|
||||
things:
|
||||
|
||||
1. **Google OAuth** — add `https://dev.jinemi.com/user/oauth2/<name>/callback`
|
||||
as an authorized redirect URI in the Google Cloud console *before* the flip.
|
||||
Not in this repo; nothing here can verify it. Miss it and no one can log in,
|
||||
including to undo the flip.
|
||||
2. **The registry host in image names** — images are named by registry host, and
|
||||
the `git.thermograph.org/` prefix is baked into the runner labels
|
||||
(`register-lan-runner.sh`, `runner-vps2/README.md`), the CI-runner image
|
||||
(`ci-runner/Dockerfile`), `REGISTRY_HOST` in `infra/.env.example`, and every
|
||||
already-pushed tag. Renaming the registry host is a separate migration from
|
||||
renaming the web UI; the two need not happen together, and doing the web UI
|
||||
alone is much the smaller change.
|
||||
3. **Mesh `/etc/hosts` pins** — every node in "Registry access from mesh
|
||||
clients" below pins `git.thermograph.org` to `10.10.0.2`. A node pulling
|
||||
under a new hostname needs its own pin, or Caddy's `/v2/*` matcher sees a
|
||||
public source IP and returns 403.
|
||||
4. **Runner instance URL** — registered runners hold the instance URL they were
|
||||
registered with. Existing runners keep working against the old name as long
|
||||
as it resolves; a *re*-registration must use whichever name is canonical then.
|
||||
|
||||
Until all four are handled, leaving `ROOT_URL` on `git.thermograph.org` is the
|
||||
correct state, not an unfinished one.
|
||||
|
||||
## Registry access from mesh clients
|
||||
|
||||
Any node that needs `docker login`/push/pull against the registry (the CI
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Only the block below (from "git.thermograph.org {") goes into the live
|
||||
# Caddyfile — append just that part, not this instructional header, or it
|
||||
# ends up as a confusing orphaned comment in production config with no
|
||||
# Only the block below (from "git.thermograph.org, dev.jinemi.com {") goes into
|
||||
# the live Caddyfile — append just that part, not this instructional header, or
|
||||
# it ends up as a confusing orphaned comment in production config with no
|
||||
# surrounding context (docker-stack.yml isn't visible from there).
|
||||
#
|
||||
# Target: /etc/caddy/Caddyfile on vps1 (the box `forgejo` is pinned to — see
|
||||
|
|
@ -9,19 +9,30 @@
|
|||
# Forgejo publishes its web UI to 127.0.0.1:3080 only (host-local), and this
|
||||
# block is the only thing that ever talks to it.
|
||||
#
|
||||
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
|
||||
# git.thermograph.org/v2/* is the built-in OCI registry API. It's blocked
|
||||
# from anywhere except the WireGuard mesh (10.10.0.0/24) — reachable to CI
|
||||
# runners and Swarm nodes over wg0, not from the public internet. Everything
|
||||
# else (web UI, git-over-HTTP, PR pages) stays public like the rest of the
|
||||
# site.
|
||||
# TWO hostnames, ONE block, and that is load-bearing — see "Registry exposure"
|
||||
# below. Both names must share a site block so the /v2/* restriction covers
|
||||
# both. Splitting dev.jinemi.com into its own block serves the same Forgejo
|
||||
# with the registry API open to the public internet.
|
||||
#
|
||||
# Update the domain below to match whatever you actually pointed at vps1's
|
||||
# IP, if not git.thermograph.org.
|
||||
# dev.jinemi.com is the migration target for git.thermograph.org; both are
|
||||
# served during the transition. Each gets its own Let's Encrypt cert
|
||||
# automatically (HTTP-01) — both A records already point at vps1.
|
||||
#
|
||||
# git.thermograph.org stays CANONICAL until Forgejo's ROOT_URL is flipped
|
||||
# (docker-stack.yml, FORGEJO_DOMAIN). Until then dev.jinemi.com serves every
|
||||
# page, but Forgejo builds absolute URLs from ROOT_URL, so clone URLs, the
|
||||
# OAuth callback and post-login redirects still name git.thermograph.org.
|
||||
# Flipping it is NOT just this file — see README.md, "Migrating the domain".
|
||||
#
|
||||
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
|
||||
# /v2/* is the built-in OCI registry API. It's blocked from anywhere except
|
||||
# the WireGuard mesh (10.10.0.0/24) — reachable to CI runners and Swarm nodes
|
||||
# over wg0, not from the public internet. Everything else (web UI,
|
||||
# git-over-HTTP, PR pages) stays public like the rest of the site.
|
||||
|
||||
# --- copy from here down into /etc/caddy/Caddyfile ---
|
||||
|
||||
git.thermograph.org {
|
||||
git.thermograph.org, dev.jinemi.com {
|
||||
encode zstd gzip
|
||||
|
||||
@registry_external {
|
||||
|
|
|
|||
Loading…
Reference in a new issue