53e2eb7c84
All checks were successful
Sync infra to hosts / sync-beta (push) Has been skipped
Sync infra to hosts / sync-prod (push) Has been skipped
Sync infra to hosts / sync-centralis (push) Has been skipped
Sync infra to hosts / sync-dev (push) Successful in 9s
secrets-guard / encrypted (push) Successful in 5s
Validate observability stack / validate (push) Successful in 12s
shell-lint / shellcheck (push) Successful in 8s
Build + push images (Forgejo registry) / build-push (frontend) (push) Successful in 26s
Build + push images (Forgejo registry) / build-push (backend) (push) Successful in 1m10s
Deploy / deploy (backend) (push) Successful in 1m41s
Deploy / deploy (frontend) (push) Successful in 1m48s
secrets-guard / encrypted (pull_request) Successful in 8s
shell-lint / shellcheck (pull_request) Successful in 9s
PR build (required check) / changes (pull_request) Successful in 20s
PR build (required check) / validate-observability (pull_request) Successful in 15s
PR build (required check) / build-frontend (pull_request) Successful in 17s
PR build (required check) / build-backend (pull_request) Successful in 2m26s
PR build (required check) / gate (pull_request) Successful in 1s
Completes the Forgejo domain migration. ROOT_URL moved to dev.jinemi.com earlier; the registry half was deliberately deferred. Every image name, REGISTRY_HOST default, runner label and --add-host pin now names dev.jinemi.com, so the registry host and the bearer-token realm agree again. Both names address the same Forgejo, so no image needs re-pushing and a rollback to a tag pushed under the old prefix still resolves. git.thermograph.org therefore stays served off the same Caddy site block -- one block, so the /v2/* mesh-only matcher keeps covering both names -- for pre-migration tags and for runners holding it as their registered instance URL. Mesh clients now pin both names in /etc/hosts: the new one as registry host and token realm, the old one for pre-migration tags. runner-vps2/config.yaml carries both --add-host entries for the same reason. Also renames Centralis' endpoint to mcp.jinemi.com in the two places this repo names it; Centralis itself is provisioned outside this repo. Host-side steps this cannot do (documented in deploy/forgejo/README.md, "Host-side steps"): the Forgejo Actions variable REGISTRY_HOST, docker login against the new host, and the /etc/hosts pins.
53 lines
2.4 KiB
Text
53 lines
2.4 KiB
Text
# Only the block below (from "dev.jinemi.com, git.thermograph.org {") goes into
|
|
# the live Caddyfile — append just that part, not this instructional header, or
|
|
# it ends up as a confusing orphaned comment in production config with no
|
|
# surrounding context (docker-stack.yml isn't visible from there).
|
|
#
|
|
# Target: /etc/caddy/Caddyfile on vps1 (the box `forgejo` is pinned to — see
|
|
# docker-stack.yml; this is the box also called "vps1", 75.119.132.91).
|
|
# Reuses vps1's existing Caddy instead of a second reverse proxy/ACME flow:
|
|
# Forgejo publishes its web UI to 127.0.0.1:3080 only (host-local), and this
|
|
# block is the only thing that ever talks to it.
|
|
#
|
|
# TWO hostnames, ONE block, and that is load-bearing — see "Registry exposure"
|
|
# below. Both names must share a site block so the /v2/* restriction covers
|
|
# both. Splitting dev.jinemi.com into its own block serves the same Forgejo
|
|
# with the registry API open to the public internet.
|
|
#
|
|
# dev.jinemi.com is CANONICAL, now on both axes — it is Forgejo's ROOT_URL
|
|
# (docker-stack.yml, FORGEJO_DOMAIN), so it is the name Forgejo puts in clone
|
|
# URLs, the OAuth callback, webhook payload URLs and mail links; and it is the
|
|
# registry host in every image name this repo builds or pulls.
|
|
#
|
|
# git.thermograph.org is kept as a served alias, NOT as dead weight, though the
|
|
# reason narrowed when the registry moved. What still needs it: image tags
|
|
# already pushed under the old prefix (a rollback to one names that host), and
|
|
# runners registered against `https://git.thermograph.org`, which hold the
|
|
# instance URL they registered with. Removing this name from the block breaks a
|
|
# rollback and de-registers runners — not just old bookmarks. Both names get
|
|
# their own Let's Encrypt cert automatically (HTTP-01); both A records point
|
|
# at vps1. See README.md, "Migrating the domain".
|
|
#
|
|
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
|
|
# /v2/* is the built-in OCI registry API. It's blocked from anywhere except
|
|
# the WireGuard mesh (10.10.0.0/24) — reachable to CI runners and Swarm nodes
|
|
# over wg0, not from the public internet. Everything else (web UI,
|
|
# git-over-HTTP, PR pages) stays public like the rest of the site.
|
|
|
|
# --- copy from here down into /etc/caddy/Caddyfile ---
|
|
|
|
dev.jinemi.com, git.thermograph.org {
|
|
encode zstd gzip
|
|
|
|
@registry_external {
|
|
path /v2/*
|
|
not remote_ip 10.10.0.0/24
|
|
}
|
|
respond @registry_external 403
|
|
|
|
reverse_proxy 127.0.0.1:3080
|
|
|
|
log {
|
|
output file /var/log/caddy/git.log
|
|
}
|
|
}
|