Rob Thijssen
d60173f0ca
deploy / fetch (push) Successful in 17s
deploy / deploy-node (bob.hanzalova.internal, 0x134e73f06fa9bdb1dbfa909e149c563f5860ceb71a0e7307918f7033970edf59, benjy.hanzalova.internal quadbrat.hanzalova.internal, --public-addr /dns4/nh.thgttg.com/tcp/30333, --unsafe-rpc-external --rpc-methods safe --rpc-c… (push) Successful in 34s
deploy / deploy-miner (1, quadbrat.hanzalova.internal, bob.hanzalova.internal) (push) Successful in 40s
deploy / deploy-miner (1, benjy.hanzalova.internal, bob.hanzalova.internal) (push) Successful in 42s
deploy / deploy-metrics (push) Successful in 8s
subxt refuses plain ws:// to any host but localhost (InsecureUrl), so quantus-cli against a remote node needs either an ssh tunnel or TLS. This adds the vhost and an edge role in infra-setup.sh to mint the cert, install it, arm step@quantus.timer and reload nginx. Operator-run rather than CI-deployed, matching lair/mail: the runner's rights never extend to reading certificate keys or reloading nginx on a shared edge proxy. Two things found while writing it. The vhost must listen on 127.0.0.1:14443 with proxy_protocol, not 443, because a stream SNI router owns 443 on the edge proxies. And the sites-available copy of an existing vhost is NOT a safe template: 11 of 19 enabled vhosts on hanzalova are regular files rather than symlinks and have drifted from sites-available since the SNI migration -- agent0's enabled copy listens on 14443 while its sites-available copy still says 443. This vhost is installed as a symlink so it cannot drift the same way. Verified: nginx -t parses the config on the real host, failing only on the not-yet-minted certificate.
57 lines
2.5 KiB
Plaintext
57 lines
2.5 KiB
Plaintext
# Mesh-only vhost for the Quantus node's JSON-RPC, fronted by the hanzalova edge
|
|
# proxy (office site). Gives tooling a `wss://` endpoint, which matters because
|
|
# subxt — and therefore quantus-cli — refuses plain `ws://` to any host but
|
|
# localhost (InsecureUrl), so without this every client needs an ssh tunnel.
|
|
#
|
|
# Cert: internal `lair` CA, minted from the operator box and renewed by
|
|
# step@quantus.timer (architecture internal-tls.md). Operator-installed, NOT
|
|
# CI-deployed: the runner has no rights on the edge proxy
|
|
# (reverse-proxies.md §4, and the same split lair/mail uses).
|
|
# ln -sf ../sites-available/quantus.internal.conf /etc/nginx/sites-enabled/
|
|
#
|
|
# listen 14443 + proxy_protocol, NOT 443: the nginx stream SNI router owns TCP
|
|
# 443 on this host and forwards every non-passthrough name to the local https
|
|
# tier (reverse-proxies.md §5). Copy this from a currently-ENABLED vhost, not
|
|
# from sites-available — several of those are stale (see the repo readme).
|
|
#
|
|
# NOTE ON EXPOSURE: this is an unauthenticated RPC. `--rpc-methods safe` on the
|
|
# node blocks the dangerous calls, but anyone who reaches this name can read all
|
|
# chain state and submit signed extrinsics. It is mesh-only by construction —
|
|
# `.internal` has no public record and must never get one.
|
|
|
|
upstream quantus_rpc_up {
|
|
server bob.hanzalova.internal:9944;
|
|
keepalive 8;
|
|
}
|
|
|
|
server {
|
|
listen 127.0.0.1:14443 ssl proxy_protocol;
|
|
http2 on;
|
|
server_name quantus.internal;
|
|
|
|
ssl_certificate /etc/nginx/tls/cert/quantus.internal.pem;
|
|
ssl_certificate_key /etc/nginx/tls/key/quantus.internal.pem;
|
|
ssl_protocols TLSv1.3;
|
|
ssl_trusted_certificate /etc/pki/ca-trust/source/anchors/root-internal.pem;
|
|
|
|
# Substrate subscriptions (chainHead_follow, new heads) are long-lived and
|
|
# can sit idle between blocks. The 60s default would drop them mid-session
|
|
# and surface to the client as an unexplained disconnect.
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
|
|
# RPC bodies are small; a large limit here only widens the DoS surface.
|
|
client_max_body_size 2m;
|
|
|
|
location / {
|
|
proxy_pass http://quantus_rpc_up;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|