rob thijssen
110b523fd0
Wires up the prod deployment per architecture-doc conventions:
- api → nikola.kosherinata.internal, loopback bind 127.0.0.1:42424
(less-common port, registered with SELinux as http_port_t).
- worker → frootmig.kosherinata.internal, no listening port.
- web (static ui/dist + nginx server_name rob.tn) → nikola, with
/api/* reverse-proxied to the loopback API.
- db → existing magrathea cluster via mTLS, hostname-baked DATABASE_URL
rendered into /etc/moments/{api,worker}.env at deploy time.
Cert rotation: step-ca renews host certs every 24h; .path units watch
/etc/pki/tls/misc/<host>.pem and trigger systemctl restart of the
relevant service. Both binaries hold cert state in rustls and read
once at startup, so restart is the right reload semantics.
deploy.sh contract matches the architecture doc: positional env arg,
component list (or `all` / `default`), --dry-run support. Renders
config templates from `pass`, rsyncs over ssh+sudo, runs sysusers /
restorecon / semanage / systemctl / nginx -t idempotently.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
66 lines
2.1 KiB
Plaintext
66 lines
2.1 KiB
Plaintext
# /etc/nginx/conf.d/rob.tn.conf — rob.tn site config for moments.
|
|
#
|
|
# Static frontend out of /var/www/moments; /api/* reverse-proxied to the
|
|
# moments-api binary on loopback. The UI fetches /api/v1/... so the strip
|
|
# matches what Vite's dev proxy does (drop the /api prefix before sending
|
|
# to axum, whose routes are mounted at /v1/*).
|
|
|
|
upstream moments_api {
|
|
server 127.0.0.1:42424 max_fails=3 fail_timeout=30s;
|
|
keepalive 8;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name rob.tn;
|
|
|
|
ssl_certificate /etc/pki/tls/misc/nikola.kosherinata.internal.pem;
|
|
ssl_certificate_key /etc/pki/tls/private/nikola.kosherinata.internal.pem;
|
|
|
|
# Public forge — visitors are not on the internal mTLS mesh, so no
|
|
# client-cert verification here. The X25519MLKEM768 default falls
|
|
# back to classical curves for clients that don't speak PQ yet.
|
|
ssl_protocols TLSv1.3;
|
|
|
|
root /var/www/moments;
|
|
index index.html;
|
|
|
|
# Static SPA: serve the file if it exists, else fall back to index.html
|
|
# so client-side routing works.
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
add_header Cache-Control "no-cache" always;
|
|
}
|
|
|
|
# Asset bundles are content-hashed by Vite — safe to cache aggressively.
|
|
location ~* \.(js|css|woff2?|ttf|eot|svg|png|jpg|jpeg|gif|ico|webp|avif)$ {
|
|
expires 30d;
|
|
add_header Cache-Control "public, max-age=2592000, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location /api/ {
|
|
# Strip /api so axum sees /v1/events, not /api/v1/events.
|
|
rewrite ^/api/(.*)$ /$1 break;
|
|
proxy_pass http://moments_api;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 30s;
|
|
proxy_connect_timeout 5s;
|
|
}
|
|
|
|
access_log /var/log/nginx/rob.tn.access.log;
|
|
error_log /var/log/nginx/rob.tn.error.log;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name rob.tn;
|
|
return 301 https://$host$request_uri;
|
|
}
|