mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-07-29 05:59:05 +03:00
cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling
Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN, and credentials pointers for mirror token recovery. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
42
sim/cluster0/lab-seeds/backend/patches/fe-nginx-APPLY.md
Normal file
42
sim/cluster0/lab-seeds/backend/patches/fe-nginx-APPLY.md
Normal file
@@ -0,0 +1,42 @@
|
||||
# FE nginx consolidation — review & apply
|
||||
|
||||
## What changes
|
||||
|
||||
- **`/etc/nginx/apps.conf`** becomes the full `apps.f0xx.org` vhost (HTTP redirect + HTTPS server + all Android Cast locations).
|
||||
- **`/etc/nginx/nginx.conf`** drops inline `apps.f0xx.org` server blocks; adds one `include /etc/nginx/apps.conf;` at `http` level.
|
||||
|
||||
## New / consolidated paths in apps.conf
|
||||
|
||||
| Path | Upstream |
|
||||
|------|----------|
|
||||
| `/v0/ota/` | BE :80 (OTA) |
|
||||
| `/app/androidcast_project/build/` | BE :80 |
|
||||
| `/app/androidcast_project/crashes/` | BE :80 |
|
||||
| `/app/androidcast_project/graphs/` | BE :80 (explicit) |
|
||||
| `/app/androidcast_project/` | BE :80 (hub) |
|
||||
| `/app/androidcast_project/git/` | BE :3000 (Gitea) |
|
||||
| `/` (default) | BE :80 |
|
||||
|
||||
Canonical template: `examples/crash_reporter/backend/nginx/fe/apps.conf`
|
||||
|
||||
## Apply (on f0xx-monstro)
|
||||
|
||||
```bash
|
||||
cd /etc/nginx
|
||||
cp -a apps.conf "apps.conf.bak.$(date +%Y%m%d)"
|
||||
cp -a nginx.conf "nginx.conf.bak.$(date +%Y%m%d)"
|
||||
# copy template from repo sync, or patch:
|
||||
# patch -p1 < .../fe-nginx-apps-consolidation.patch
|
||||
cp /path/to/android_cast/examples/crash_reporter/backend/nginx/fe/apps.conf apps.conf
|
||||
# edit nginx.conf: replace apps.f0xx.org server {…} blocks with:
|
||||
# include /etc/nginx/apps.conf;
|
||||
nginx -t && rc-service nginx reload
|
||||
```
|
||||
|
||||
## Verify
|
||||
|
||||
```bash
|
||||
curl -sS -o /dev/null -w 'hub %{http_code}\n' https://apps.f0xx.org/app/androidcast_project/
|
||||
curl -sS -o /dev/null -w 'ota %{http_code}\n' https://apps.f0xx.org/v0/ota/channel/stable.json
|
||||
curl -sS -o /dev/null -w 'build %{http_code}\n' https://apps.f0xx.org/app/androidcast_project/build/
|
||||
```
|
||||
@@ -0,0 +1,271 @@
|
||||
--- a/etc/nginx/apps.conf 2026-06-10 16:57:53.240415810 +0200
|
||||
+++ b/etc/nginx/apps.conf 2026-06-10 16:57:53.246704804 +0200
|
||||
@@ -1,23 +1,137 @@
|
||||
-# location /app/androidcast_project/build/ {
|
||||
-# proxy_pass https://artc0.intra.raptor.org/app/androidcast_project/build/;
|
||||
-# }
|
||||
-
|
||||
- # Redirect without trailing slash
|
||||
- location = /app/androidcast_project/build {
|
||||
- return 301 $scheme://$host/app/androidcast_project/build/;
|
||||
- }
|
||||
- location /app/androidcast_project/build/ {
|
||||
- proxy_pass http://artc0.intra.raptor.org:80;
|
||||
- proxy_http_version 1.1;
|
||||
- proxy_set_header Host $host;
|
||||
- proxy_set_header X-Real-IP $remote_addr;
|
||||
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
- proxy_set_header X-Forwarded-Proto $scheme;
|
||||
- proxy_set_header X-Forwarded-Host $host;
|
||||
- proxy_set_header Upgrade $http_upgrade;
|
||||
- proxy_set_header Connection $connection_upgrade;
|
||||
- proxy_read_timeout 1800s;
|
||||
- proxy_send_timeout 1800s;
|
||||
- client_max_body_size 512m;
|
||||
- }
|
||||
+# apps.f0xx.org — Android Cast public vhost (FE Gentoo).
|
||||
+# Included from nginx.conf: include /etc/nginx/apps.conf;
|
||||
+#
|
||||
+# Upstream: BE nginx on artc0.intra.raptor.org:80 (hub PHP, crashes, graphs, build, OTA).
|
||||
+# Git browser: BE :3000 (Gitea). Do not proxy androidcast to BE :443 or :8089.
|
||||
+#
|
||||
+# Reload: nginx -t && rc-service nginx reload
|
||||
|
||||
+server {
|
||||
+ listen 80;
|
||||
+ server_name apps.f0xx.org;
|
||||
+ return 301 https://$host$request_uri;
|
||||
+}
|
||||
+
|
||||
+server {
|
||||
+ listen 443 ssl http2;
|
||||
+ server_name apps.f0xx.org;
|
||||
+
|
||||
+ access_log /var/log/nginx/apps.intra.raptor.org.access_log main;
|
||||
+ error_log /var/log/nginx/apps.intra.raptor.org.error_log info;
|
||||
+
|
||||
+ ssl_certificate /etc/letsencrypt/live/apps.f0xx.org/fullchain.pem;
|
||||
+ ssl_certificate_key /etc/letsencrypt/live/apps.f0xx.org/privkey.pem;
|
||||
+
|
||||
+ # --- OTA artifacts (BE static tree on listen 80) ---
|
||||
+ location ^~ /v0/ota/ {
|
||||
+ proxy_pass http://artc0.intra.raptor.org:80;
|
||||
+ proxy_http_version 1.1;
|
||||
+ proxy_set_header Host $host;
|
||||
+ proxy_set_header X-Real-IP $remote_addr;
|
||||
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
+ proxy_set_header X-Forwarded-Proto $scheme;
|
||||
+ }
|
||||
+
|
||||
+ # --- APK builder (long-running Docker builds) ---
|
||||
+ location = /app/androidcast_project/build {
|
||||
+ return 301 $scheme://$host/app/androidcast_project/build/;
|
||||
+ }
|
||||
+ location ^~ /app/androidcast_project/build/ {
|
||||
+ proxy_pass http://artc0.intra.raptor.org:80;
|
||||
+ proxy_http_version 1.1;
|
||||
+ proxy_set_header Host $host;
|
||||
+ proxy_set_header X-Real-IP $remote_addr;
|
||||
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
+ proxy_set_header X-Forwarded-Proto $scheme;
|
||||
+ proxy_set_header X-Forwarded-Host $host;
|
||||
+ proxy_set_header Upgrade $http_upgrade;
|
||||
+ proxy_set_header Connection $connection_upgrade;
|
||||
+ proxy_read_timeout 1800s;
|
||||
+ proxy_send_timeout 1800s;
|
||||
+ client_max_body_size 512m;
|
||||
+ }
|
||||
+
|
||||
+ # --- Crash / ticket console ---
|
||||
+ location = /app/androidcast_project/crashes {
|
||||
+ return 301 $scheme://$host/app/androidcast_project/crashes/;
|
||||
+ }
|
||||
+ location ^~ /app/androidcast_project/crashes/ {
|
||||
+ proxy_pass http://artc0.intra.raptor.org:80;
|
||||
+ proxy_http_version 1.1;
|
||||
+ proxy_set_header Host $host;
|
||||
+ proxy_set_header X-Real-IP $remote_addr;
|
||||
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
+ proxy_set_header X-Forwarded-Proto $scheme;
|
||||
+ client_max_body_size 16m;
|
||||
+ }
|
||||
+
|
||||
+ # --- Graphs dashboard ---
|
||||
+ location = /app/androidcast_project/graphs {
|
||||
+ return 301 $scheme://$host/app/androidcast_project/graphs/;
|
||||
+ }
|
||||
+ location ^~ /app/androidcast_project/graphs/ {
|
||||
+ proxy_pass http://artc0.intra.raptor.org:80;
|
||||
+ proxy_http_version 1.1;
|
||||
+ proxy_set_header Host $host;
|
||||
+ proxy_set_header X-Real-IP $remote_addr;
|
||||
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
+ proxy_set_header X-Forwarded-Proto $scheme;
|
||||
+ }
|
||||
+
|
||||
+ # --- Hub landing (PHP index) ---
|
||||
+ location = /app/androidcast_project {
|
||||
+ return 301 $scheme://$host/app/androidcast_project/;
|
||||
+ }
|
||||
+ location ^~ /app/androidcast_project/ {
|
||||
+ proxy_pass http://artc0.intra.raptor.org:80;
|
||||
+ proxy_http_version 1.1;
|
||||
+ proxy_set_header Host $host;
|
||||
+ proxy_set_header X-Real-IP $remote_addr;
|
||||
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
+ proxy_set_header X-Forwarded-Proto $scheme;
|
||||
+ }
|
||||
+
|
||||
+ # --- Gitea web UI ---
|
||||
+ location = /app/androidcast_project/git {
|
||||
+ return 301 $scheme://$host/app/androidcast_project/git/;
|
||||
+ }
|
||||
+ location ^~ /app/androidcast_project/git/ {
|
||||
+ proxy_pass http://artc0.intra.raptor.org:3000/;
|
||||
+ proxy_http_version 1.1;
|
||||
+ proxy_set_header Host $host;
|
||||
+ proxy_set_header X-Real-IP $remote_addr;
|
||||
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
+ proxy_set_header X-Forwarded-Proto $scheme;
|
||||
+ proxy_set_header X-Forwarded-Host $host;
|
||||
+ proxy_set_header Upgrade $http_upgrade;
|
||||
+ proxy_set_header Connection $connection_upgrade;
|
||||
+ proxy_read_timeout 1800s;
|
||||
+ proxy_send_timeout 1800s;
|
||||
+ client_max_body_size 512m;
|
||||
+ }
|
||||
+
|
||||
+ # --- Default: anything else on this vhost → BE :80 ---
|
||||
+ location / {
|
||||
+ proxy_pass http://artc0.intra.raptor.org:80;
|
||||
+ proxy_http_version 1.1;
|
||||
+ proxy_set_header Host $host;
|
||||
+ proxy_set_header X-Real-IP $remote_addr;
|
||||
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
+ proxy_set_header X-Forwarded-Proto $scheme;
|
||||
+ proxy_connect_timeout 120s;
|
||||
+ proxy_send_timeout 120s;
|
||||
+ proxy_read_timeout 180s;
|
||||
+ proxy_buffers 16 16m;
|
||||
+ proxy_buffer_size 16m;
|
||||
+ client_body_buffer_size 16m;
|
||||
+ client_max_body_size 16m;
|
||||
+ proxy_buffering off;
|
||||
+ proxy_set_header Upgrade $http_upgrade;
|
||||
+ proxy_set_header Connection $connection_upgrade;
|
||||
+ proxy_cache_bypass $http_upgrade;
|
||||
+ }
|
||||
+
|
||||
+ location ~ /\.ht {
|
||||
+ deny all;
|
||||
+ }
|
||||
+}
|
||||
--- a/etc/nginx/nginx.conf 2026-06-10 16:57:52.277069336 +0200
|
||||
+++ b/etc/nginx/nginx.conf 2026-06-10 16:57:53.277208423 +0200
|
||||
@@ -918,104 +918,8 @@
|
||||
|
||||
|
||||
## -------------------------------------------------------------------------------
|
||||
+## apps.f0xx.org — Android Cast (hub, crashes, graphs, build, OTA, git)
|
||||
+ include /etc/nginx/apps.conf;
|
||||
|
||||
- server {
|
||||
- listen 80;
|
||||
- server_name apps.f0xx.org;
|
||||
- location / {
|
||||
- rewrite ^(.*)$ https://apps.f0xx.org$1 permanent;
|
||||
- }
|
||||
- # redirects both www and non-www to https
|
||||
- return 301 https://apps.f0xx.org$request_uri;
|
||||
- }
|
||||
- server {
|
||||
- listen 443 ssl http2;
|
||||
- server_name apps.f0xx.org;
|
||||
-
|
||||
- access_log /var/log/nginx/apps.intra.raptor.org.access_log main;
|
||||
- error_log /var/log/nginx/apps.intra.raptor.org.error_log info;
|
||||
-
|
||||
- ssl_certificate /etc/letsencrypt/live/apps.f0xx.org/fullchain.pem;
|
||||
- ssl_certificate_key /etc/letsencrypt/live/apps.f0xx.org/privkey.pem;
|
||||
-
|
||||
- location / {
|
||||
- proxy_pass http://artc0.intra.raptor.org:80;
|
||||
- proxy_set_header Host $host;
|
||||
- proxy_set_header X-Real-IP $remote_addr;
|
||||
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
- proxy_set_header X-Forwarded-Proto $scheme;
|
||||
- proxy_connect_timeout 120;
|
||||
- proxy_send_timeout 120;
|
||||
- proxy_read_timeout 180;
|
||||
- proxy_buffers 16 16M;
|
||||
- proxy_buffer_size 16M;
|
||||
- client_body_buffer_size 16M;
|
||||
- client_max_body_size 16M;
|
||||
- proxy_buffering off;
|
||||
- proxy_set_header Upgrade $http_upgrade;
|
||||
- proxy_set_header Connection keep-alive;
|
||||
- proxy_set_header Host $host;
|
||||
- proxy_cache_bypass $http_upgrade;
|
||||
- proxy_set_header Connection "upgrade";
|
||||
- }
|
||||
-
|
||||
- #location /app/androidcast_project/ {
|
||||
- # proxy_pass https://artc0.intra.raptor.org/app/androidcast_project/;
|
||||
- #}
|
||||
-#
|
||||
-# location /app/androidcast_project/crashes/ {
|
||||
-# proxy_pass https://artc0.intra.raptor.org/app/androidcast_project/crashes/;
|
||||
-# }
|
||||
-#
|
||||
-
|
||||
- location /app/androidcast_project/ {
|
||||
- proxy_pass http://artc0.intra.raptor.org:80;
|
||||
- proxy_http_version 1.1;
|
||||
- proxy_set_header Host $host;
|
||||
- proxy_set_header X-Real-IP $remote_addr;
|
||||
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
- proxy_set_header X-Forwarded-Proto $scheme;
|
||||
- }
|
||||
-
|
||||
- location /app/androidcast_project/crashes/ {
|
||||
- proxy_pass http://artc0.intra.raptor.org:80;
|
||||
- proxy_http_version 1.1;
|
||||
- proxy_set_header Host $host;
|
||||
- proxy_set_header X-Real-IP $remote_addr;
|
||||
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
- proxy_set_header X-Forwarded-Proto $scheme;
|
||||
- }
|
||||
-
|
||||
- include /etc/nginx/apps.conf;
|
||||
-
|
||||
- location ~ /\.ht {
|
||||
- deny all;
|
||||
- }
|
||||
-
|
||||
- root /var/www/localhost/htdocs/android_cast/project/android_cast/examples/crash_reporter/backend/public/;
|
||||
- index index.php;
|
||||
-
|
||||
-
|
||||
-## gitea redirection
|
||||
-# Redirect without trailing slash
|
||||
- location = /app/androidcast_project/git {
|
||||
- return 301 $scheme://$host/app/androidcast_project/git/;
|
||||
- }
|
||||
- location /app/androidcast_project/git/ {
|
||||
- proxy_pass http://artc0.intra.raptor.org:3000/;
|
||||
- proxy_http_version 1.1;
|
||||
- proxy_set_header Host $host;
|
||||
- proxy_set_header X-Real-IP $remote_addr;
|
||||
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
- proxy_set_header X-Forwarded-Proto $scheme;
|
||||
- proxy_set_header X-Forwarded-Host $host;
|
||||
- proxy_set_header Upgrade $http_upgrade;
|
||||
- proxy_set_header Connection $connection_upgrade;
|
||||
- proxy_read_timeout 1800s;
|
||||
- proxy_send_timeout 1800s;
|
||||
- client_max_body_size 512m;
|
||||
- }
|
||||
-
|
||||
- }
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user