d7c912c7f4
Quadlets captured from the live units on bob, with the real immutable tags (0.1.44-ge06652a) rather than a placeholder, plus the hanzalova vhost that mounts the relay on /relay-api/ of the existing name. Verified end to end: /relay-api/health returns ok through the prefix, the relay's nested /v1 routes answer 401 rather than 404 (so the strip reaches them and they are genuinely protected), the remote's own /v1 is unaffected, and the served SPA bundle now carries the origin-relative /relay-api base. The vhost is committed because it is half the design: the relay only works on a path because nginx strips the prefix, and a future kanban.l4ir.net needs exactly this location block and nothing else.
45 lines
1.9 KiB
Plaintext
45 lines
1.9 KiB
Plaintext
# vibe-kanban relay — brokers pairing and the browser<->host data path.
|
|
#
|
|
# Hosts run the ordinary local vibe-kanban server (`npx vibe-kanban`, the
|
|
# `server` crate). It registers here over a websocket control channel and the
|
|
# browser reaches the host's local API through this relay via WebRTC, so this is
|
|
# the data path and not merely discovery. Without it the UI can list hosts
|
|
# (remote's GET /hosts) but can never pair one.
|
|
#
|
|
# Mounted on a PATH of the existing name rather than its own domain:
|
|
# https://kanban.internal/relay-api/ -> here, with nginx stripping the prefix.
|
|
# Every relay URL on both sides is composed as {base}/v1/..., and the relay has
|
|
# no notion of its own public address (RelayServerConfig is only database_url,
|
|
# listen_addr and jwt_secret), so a prefix is invisible to it. Same-origin also
|
|
# means no CORS, one less certificate and one less step@ renewal timer — and
|
|
# when kanban.l4ir.net lands it inherits the relay by copying one location
|
|
# block, with the SPA unchanged because its relay base is origin-relative.
|
|
#
|
|
# The JWT secret is deliberately the SAME as the remote server's: that is how
|
|
# the relay trusts tokens the remote issued. Both read /etc/vibe-kanban/env.
|
|
#
|
|
# Ordering: it needs the database, and it authenticates tokens minted by the
|
|
# remote server, so it starts after both.
|
|
[Unit]
|
|
Description=vibe-kanban relay server
|
|
After=network-online.target vibe-kanban-db.service vibe-kanban.service
|
|
Wants=network-online.target
|
|
Requires=vibe-kanban-db.service
|
|
|
|
[Container]
|
|
Image=git.lair.cafe/lair/vibe-kanban-relay:0.1.44-ge06652a
|
|
ContainerName=vibe-kanban-relay
|
|
Network=vibe-kanban.network
|
|
# Published to the LAN so the hanzalova edge proxy can reach it; the browser and
|
|
# the hosts both arrive through nginx, never directly.
|
|
PublishPort=27181:8082
|
|
EnvironmentFile=/etc/vibe-kanban/env
|
|
Environment=RELAY_LISTEN_ADDR=0.0.0.0:8082
|
|
|
|
[Service]
|
|
Restart=always
|
|
TimeoutStartSec=120
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target default.target
|