d60173f0ca
All checks were successful
deploy / fetch (push) Successful in 17s
deploy / deploy-node (bob.hanzalova.internal, 0x134e73f06fa9bdb1dbfa909e149c563f5860ceb71a0e7307918f7033970edf59, benjy.hanzalova.internal quadbrat.hanzalova.internal, --public-addr /dns4/nh.thgttg.com/tcp/30333, --unsafe-rpc-external --rpc-methods safe --rpc-c… (push) Successful in 34s
deploy / deploy-miner (1, quadbrat.hanzalova.internal, bob.hanzalova.internal) (push) Successful in 40s
deploy / deploy-miner (1, benjy.hanzalova.internal, bob.hanzalova.internal) (push) Successful in 42s
deploy / deploy-metrics (push) Successful in 8s
subxt refuses plain ws:// to any host but localhost (InsecureUrl), so quantus-cli against a remote node needs either an ssh tunnel or TLS. This adds the vhost and an edge role in infra-setup.sh to mint the cert, install it, arm step@quantus.timer and reload nginx. Operator-run rather than CI-deployed, matching lair/mail: the runner's rights never extend to reading certificate keys or reloading nginx on a shared edge proxy. Two things found while writing it. The vhost must listen on 127.0.0.1:14443 with proxy_protocol, not 443, because a stream SNI router owns 443 on the edge proxies. And the sites-available copy of an existing vhost is NOT a safe template: 11 of 19 enabled vhosts on hanzalova are regular files rather than symlinks and have drifted from sites-available since the SNI migration -- agent0's enabled copy listens on 14443 while its sites-available copy still says 443. This vhost is installed as a symlink so it cannot drift the same way. Verified: nginx -t parses the config on the real host, failing only on the not-yet-minted certificate.