cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling

Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts
for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN,
and credentials pointers for mirror token recovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/lab-seeds/backend/nginx/fe/apps.conf

@@ -0,0 +1,137 @@
+# apps.f0xx.org — Android Cast public vhost (FE Gentoo).
+# Included from nginx.conf:  include /etc/nginx/apps.conf;
+#
+# Upstream: BE nginx on artc0.intra.raptor.org:80 (hub PHP, crashes, graphs, build, OTA).
+# Git browser: BE :3000 (Gitea).  Do not proxy androidcast to BE :443 or :8089.
+#
+# Reload:  nginx -t && rc-service nginx reload
+
+server {
+	listen 80;
+	server_name apps.f0xx.org;
+	return 301 https://$host$request_uri;
+}
+
+server {
+	listen 443 ssl http2;
+	server_name apps.f0xx.org;
+
+	access_log /var/log/nginx/apps.intra.raptor.org.access_log main;
+	error_log /var/log/nginx/apps.intra.raptor.org.error_log info;
+
+	ssl_certificate /etc/letsencrypt/live/apps.f0xx.org/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/apps.f0xx.org/privkey.pem;
+
+	# --- OTA artifacts (BE static tree on listen 80) ---
+	location ^~ /v0/ota/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	# --- APK builder (long-running Docker builds) ---
+	location = /app/androidcast_project/build {
+		return 301 $scheme://$host/app/androidcast_project/build/;
+	}
+	location ^~ /app/androidcast_project/build/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_read_timeout 1800s;
+		proxy_send_timeout 1800s;
+		client_max_body_size 512m;
+	}
+
+	# --- Crash / ticket console ---
+	location = /app/androidcast_project/crashes {
+		return 301 $scheme://$host/app/androidcast_project/crashes/;
+	}
+	location ^~ /app/androidcast_project/crashes/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		client_max_body_size 16m;
+	}
+
+	# --- Graphs dashboard ---
+	location = /app/androidcast_project/graphs {
+		return 301 $scheme://$host/app/androidcast_project/graphs/;
+	}
+	location ^~ /app/androidcast_project/graphs/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	# --- Hub landing (PHP index) ---
+	location = /app/androidcast_project {
+		return 301 $scheme://$host/app/androidcast_project/;
+	}
+	location ^~ /app/androidcast_project/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	# --- Gitea web UI ---
+	location = /app/androidcast_project/git {
+		return 301 $scheme://$host/app/androidcast_project/git/;
+	}
+	location ^~ /app/androidcast_project/git/ {
+		proxy_pass http://artc0.intra.raptor.org:3000/;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_read_timeout 1800s;
+		proxy_send_timeout 1800s;
+		client_max_body_size 512m;
+	}
+
+	# --- Default: anything else on this vhost → BE :80 ---
+	location / {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_connect_timeout 120s;
+		proxy_send_timeout 120s;
+		proxy_read_timeout 180s;
+		proxy_buffers 16 16m;
+		proxy_buffer_size 16m;
+		client_body_buffer_size 16m;
+		client_max_body_size 16m;
+		proxy_buffering off;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_cache_bypass $http_upgrade;
+	}
+
+	location ~ /\.ht {
+		deny all;
+	}
+}

sim/cluster0/lab-seeds/backend/nginx/rssh-bastion-stream.conf.example

@@ -0,0 +1,20 @@
+# FE nginx stream — TCP proxy to BE sshd for RSSH bastion (ra.apps.f0xx.org:443).
+# Install on FE (Gentoo); BE runs openssh with Match User ra-* (see sshd_config.d/ra.conf).
+#
+# *** DO NOT install under BE /etc/nginx/stream.d/ ***
+# BE already uses listen 443 ssl in conf.d/apps.conf (http). Stream listen 443 here
+# causes: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address in use)
+#
+# Include from nginx.conf:
+#   include /etc/nginx/stream.d/rssh-bastion.conf;
+
+upstream rssh_bastion_be {
+    server 10.7.16.128:22;  # artc0 / alpine-be — adjust for cluster/lab
+}
+
+server {
+    listen 443;
+    proxy_pass rssh_bastion_be;
+    proxy_connect_timeout 30s;
+    proxy_timeout 24h;
+}