rob thijssen
4ee7da4f97
All checks were successful
build-prerelease / Resolve version stamps + change detection (push) Successful in 32s
build-prerelease / Lint (fmt + clippy) (push) Has been skipped
build-prerelease / Build neuron-blackwell (push) Has been skipped
build-prerelease / Build neuron-ampere (push) Has been skipped
build-prerelease / Build neuron-ada (push) Has been skipped
build-prerelease / Package helexa-neuron-ada RPM (push) Has been skipped
build-prerelease / Package helexa-neuron-ampere RPM (push) Has been skipped
build-prerelease / Package helexa-neuron-blackwell RPM (push) Has been skipped
build-prerelease / Test (push) Has been skipped
build-prerelease / Build cortex binary (push) Has been skipped
build-prerelease / Build helexa-bench binary (push) Has been skipped
build-prerelease / Package cortex RPM (push) Has been skipped
build-prerelease / Package helexa-bench RPM (push) Has been skipped
build-prerelease / Publish to rpm.lair.cafe (unstable) (push) Has been skipped
Inside the WireGuard mesh, bench.helexa.ai dead-ends at the OPNsense LAN
interface (only WAN :443 is port-forwarded), so add an internal path:
- asset/nginx/bench.internal.conf — server_name bench.internal, internal
"lair" CA cert, same SPA + /api→bob proxy. Mirrors the *.internal vhost
convention on oolon.kosherinata.internal.
- asset/systemd/step@.{service,timer} — replicate oolon's smallstep cert
renewal (step ca renew via mTLS, every 15 min, reload nginx).
- infra-setup.sh: install the step@ units + /etc/nginx/tls/{cert,key},
install the vhost + enable step@bench.timer once the cert exists; prints
the one-time issuance command otherwise.
Initial cert issuance (JWK provisioner) and bench.internal DNS are
operator steps.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
35 lines
1.2 KiB
Plaintext
35 lines
1.2 KiB
Plaintext
# Internal bench UI vhost — https://bench.internal, reachable from inside
|
|
# the WireGuard mesh (the public bench.helexa.ai dead-ends at the OPNsense
|
|
# LAN interface, which only port-forwards :443 from the WAN). Same SPA +
|
|
# /api→bob proxy as bench.helexa.ai, but with an internal-CA cert
|
|
# (smallstep "lair", renewed by step@bench.timer). Mirrors the
|
|
# *.internal vhost convention on oolon.kosherinata.internal.
|
|
server {
|
|
server_name bench.internal;
|
|
listen 443 ssl;
|
|
http2 on;
|
|
|
|
ssl_certificate /etc/nginx/tls/cert/bench.internal.pem;
|
|
ssl_certificate_key /etc/nginx/tls/key/bench.internal.pem;
|
|
ssl_trusted_certificate /etc/pki/ca-trust/source/anchors/root-internal.pem;
|
|
ssl_protocols TLSv1.3;
|
|
|
|
# Shared webroot with the public vhost — same built SPA.
|
|
root /var/www/bench.helexa.ai;
|
|
index index.html;
|
|
|
|
location /api/ {
|
|
proxy_pass http://bob.hanzalova.internal:13132;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60s;
|
|
}
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|