ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-07-29 05:59:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling

Browse Source 
Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts
for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN,
and credentials pointers for mirror token recovery.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-06-23 17:07:46 +02:00
parent 98f30786b7
commit c554dc761d
209 changed files with 31249 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

124
sim/cluster0/lab-seeds/backend/config/config.example.php Normal file
View File

@@ -0,0 +1,124 @@
<?php
/*
* package examples/crash_reporter/backend/config/config.example.php
* config.example.php
* Created at: Wed 20 May 2026 14:31:55 +0200
* Updated at: Wed 20 May 2026 15:17:13 +0200 by Anton Afanasyeu <a.afanasieff@gmail.com>
* Commit: 5d8e82d2e60a21fff3138d2a394ee4e8b4c6dcb8
* Contributors:
* - Anton Afanasyeu <a.afanasieff@gmail.com> (2 commits, 23 lines)
* - Cursor Agent (project assistant)
* Digest: SHA256 fcd4a89ef4201736923d0e7e1ad88868bba7e39eadb9fcf0ffb9d1ba7efecd12
*/
return [
'app_name' => 'Android Cast',
// Console (issues/tickets/…) — production path
'project_base_path' => '/app/androidcast_project',
'base_path' => '/app/androidcast_project/issues',
// Legacy alias kept for redirects/nginx; do not use in new links
'legacy_base_path' => '/app/androidcast_project/crashes',
'db' => [
// sqlite = default file DB; mysql = MariaDB/MySQL (recommended on BE for concurrency)
'driver' => 'sqlite', // sqlite | mysql | mariadb (alias)
'sqlite_path' => __DIR__ . '/../data/crashes.sqlite',
'mysql' => [
// Alpine: if TCP fails with "Connection refused", set socket (see /etc/my.cnf.d/*.cnf)
'host' => '127.0.0.1',
'port' => 3306,
'socket' => '/run/mysqld/mysqld.sock', // leave '' to use host+port only
'database' => 'androidcast_crashes',
'username' => 'androidcast',
'password' => 'change-me',
'charset' => 'utf8mb4',
],
],
'session_name' => 'ac_crash_sess',
// Shared login cookie across crashes, build, and other consoles under this path
'session_cookie_path' => '/app/androidcast_project',
// When true, upload API may include a short error hint (do not enable on public prod long-term)
'debug' => false,
// Phase 1 RBAC: anonymous uploads and legacy rows attach to this company
'rbac' => [
'default_company_slug' => 'default',
'default_company_id' => 1,
],
// Google Analytics 4 (hub + crash console share public/assets/js/analytics.js)
'analytics' => [
'enabled' => false,
'measurement_id' => '', // e.g. G-XXXXXXXXXX
'debug' => false,
],
// On-demand remote access (WireGuard v1) — see docs/REMOTE_ACCESS_IMPL.md
'remote_access' => [
// Public UDP endpoint (FE DNAT → BE wg0 ListenPort)
'wg_endpoint' => 'ra.apps.f0xx.org:45340',
// wg show wg0 public-key on BE — REQUIRED for production connect
'wg_server_public_key' => 'EV2nnwHH7xe3jA5J46Rjtl8ao+ybZinibKg2Hy83GBw=',
'wg_interface' => 'wg0',
// Client / server addresses (must match wg0 Address subnet on BE)
'wg_server_allowed_ips' => '172.200.2.1/32',
'wg_client_ip_prefix' => '172.200.2.',
'wg_client_ip_min' => 10,
'wg_client_ip_max' => 250,
// Prefix for `wg set` when PHP-FPM runs as nobody (see examples/wireguard/alpine-be-sudoers-wg)
'wg_set_prefix' => 'sudo -n ',
'provision_peers' => true,
'require_wg_tools' => true,
'session_ttl_s' => 3600,
'min_poll_interval_s' => 45,
// Reverse SSH (alpha): outbound -R from device; no VpnService on phone
'rssh' => [
'bastion_host' => 'ra.apps.f0xx.org',
'bastion_port' => 443,
'username_prefix' => 'ra-',
'local_forward_port' => 8022,
'remote_port_min' => 18000,
'remote_port_max' => 18999,
// Lab/prod: create ephemeral Match User ra-* on BE sshd (see scripts/rssh_bastion_user.sh)
'provision_users' => false,
'provision_script' => '', // default: backend/scripts/rssh_bastion_user.sh
],
],
// Outbound mail (registration verify, password reset) — see docs/20260607-2FA-email-mobile-auth-flow.md
'auth' => [
// 32+ char secret for encrypting TOTP seeds + hashing auth attempts
'encryption_key' => '',
'max_attempts' => 8,
'lockout_window_minutes' => 15,
],
// SFU / WebRTC relay (post-alpha) — hidden until owner spec; see examples/sfu/README.md
'sfu' => [
'enabled' => false,
'signaling_url' => '', // e.g. wss://apps.f0xx.org/sfu/signal
'janus_url' => '', // lab only — port 8089 is a separate stack (INFRA.md)
],
'mail' => [
'transport' => 'smtp', // smtp | sendmail
// Alpha: use apex if apps.f0xx.org has CNAME (no MX on subdomain) — see tmp/20260608_help_request.md
'from' => 'Android Cast Issues <noreply@f0xx.org>',
'reply_to' => 'info@apps.f0xx.org',
'smtp' => [
'host' => '127.0.0.1',
'port' => 587,
'encryption' => 'tls', // tls | ssl | ''
'username' => '',
'password' => '', // set in prod config.php only — not in git
],
],
// URL shortener admin (hub Short links card) — MariaDB url_shortener on BE
'url_shortener' => [
'enabled' => false,
'public_base' => 'https://s.f0xx.org',
'db' => [
'mysql' => [
'host' => '127.0.0.1',
'port' => 3306,
'socket' => '/run/mysqld/mysqld.sock',
'database' => 'url_shortener',
'username' => 'androidcast',
'password' => 'change-me',
'charset' => 'utf8mb4',
],
],
],
];

59
sim/cluster0/lab-seeds/backend/config/config.php.alpine Normal file
View File

@@ -0,0 +1,59 @@
<?php
/*
* package examples/crash_reporter/backend/config/config.php
* config.php
* Created at: Wed 20 May 2026 14:31:55 +0200
* Updated at: Wed 20 May 2026 15:17:13 +0200 by Anton Afanasyeu <a.afanasieff@gmail.com>
* Commit: 5d8e82d2e60a21fff3138d2a394ee4e8b4c6dcb8
* Contributors:
* - Anton Afanasyeu <a.afanasieff@gmail.com> (2 commits, 22 lines)
* - Cursor Agent (project assistant)
* Digest: SHA256 8b7149a4cd8a0f7d13ee8a22535c3697e919e35b9fe5bb8a80764769cc6c6853
*/
return [
'app_name' => 'Android Cast Crashes',
'base_path' => '/app/androidcast_project/crashes',
'db' => [
'driver' => 'mysql', // sqlite | mysql
'sqlite_path' => __DIR__ . '/../data/crashes.sqlite',
'mysql' => [
'host' => '127.0.0.1',
'port' => 3306,
'socket' => '/run/mysqld/mysqld.sock',
'database' => 'androidcast_crashes',
'username' => 'androidcast',
'password' => 'androidcastrootowned',
'charset' => 'utf8mb4',
],
],
'session_name' => 'ac_crash_sess',
// Shared login cookie across crashes, build, and other consoles under this path
'session_cookie_path' => '/app/androidcast_project',
// When true, upload API may include a short error hint (do not enable on public prod long-term)
'debug' => true,
// Phase 1 RBAC: anonymous uploads and legacy rows attach to this company
'rbac' => [
'default_company_slug' => 'default',
'default_company_id' => 1,
],
// Google Analytics 4 (hub + crash console share public/assets/js/analytics.js)
'analytics' => [
'enabled' => true,
'measurement_id' => 'G-8RKGWGQ52P', // e.g. G-XXXXXXXXXX
'debug' => false,
],
// On-demand remote access (WireGuard v1) — see docs/REMOTE_ACCESS_IMPL.md
'remote_access' => [
// Public UDP endpoint shown to devices (FE DNAT → BE wg0)
'wg_endpoint' => 'ra.apps.f0xx.org:45340',
// Server WG public key (wg show wg0 public-key on BE)
'wg_server_public_key' => 'EV2nnwHH7xe3jA5J46Rjtl8ao+ybZinibKg2Hy83GBw=',
'wg_interface' => 'wg0',
// Run `wg set wg0 peer …` when device receives connect (requires wireguard-tools on BE)
'provision_peers' => true,
// Reject connect if wg genkey/pubkey unavailable (set true on production BE)
'require_wg_tools' => true,
'session_ttl_s' => 3600,
'min_poll_interval_s' => 45,
],
];