ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-07-29 00:58:20 +03:00
Code Issues Packages Projects Releases Wiki Activity
62 Commits 1 Branch 0 Tags
next
Commit Graph

62 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anton Afanasyeu
e1a7732712 nginx: serve legacy crashes/api/heartbeat.php without 301 redirect. 
Old app RA polls POST here; 301 made HttpURLConnection retry as GET → 405 on heartbeat.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-12 20:42:51 +02:00
Anton Afanasyeu
c073309d8c Lab seeds: iodine tunnel domain default iod.airie.me. 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-12 19:46:05 +02:00
Anton Afanasyeu
e49f13dfbd Lab seeds: heartbeat GET compat, iodine RA sessions, UI hints. 
Sync composed-backend sources for legacy device self-test 405 fix and iodine remote access.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-12 19:44:37 +02:00
Anton Afanasyeu
ab9b4ecae2 Use QrBrandedRenderer for lab-seed short-link QR PNG generation. 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-12 14:21:14 +02:00
Anton Afanasyeu
b3901e3955 bump deps: sync platform-php, platform-web, identity, scripts 
Signed-off-by: Anton Afanasyeu <a.afanasieff@gmail.com>
 2026-07-12 13:54:55 +02:00
Anton Afanasyeu
465efa8d98 feat(deploy): lab-seeds sync, msmtp nginx-readable secret, hub downloads 
Signed-off-by: Anton Afanasyeu <a.afanasieff@gmail.com>
 2026-07-12 13:53:38 +02:00
Anton Afanasyeu
624c9d3d7e fix(2fa): stop redirecting mobile approve GET to login page 
QR scan must open one-tap approve directly; token in URL is sufficient.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-11 21:40:01 +02:00
Anton Afanasyeu
ca28a7b97d fix(cluster0): QR 2FA one-tap approve; default public origin apps.f0xx.org 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-11 17:33:43 +02:00
Anton Afanasyeu
d6f435ada0 fix(lab-seeds): align login and QR approve views with ac-be-auth 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-11 16:16:42 +02:00
Anton Afanasyeu
eaee3d051d Sync lab-seeds to /shared/cluster in sync-cluster-scripts. 
Ensures composed backend overlays include media pipeline PHP/API/JS after
ac-deploy updates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-11 15:33:42 +02:00
Anton Afanasyeu
2a8d76fdc4 Fix ac-ms-media-transcode seed when workspace checkout is empty stub. 
Prefer /mnt/repos/ac/ac-ms-media-transcode copy when workspace tree lacks
bin/run.sh and pirate_drift.png.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-11 15:30:26 +02:00
Anton Afanasyeu
a44954e108 Ensure ac-ms-media-transcode is cloned on lab nodes during compose. 
Fallback git clone when workspace submodule is missing; include repo in
deploy-ac-workspace compose submodule list.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-11 15:28:00 +02:00
Anton Afanasyeu
b8bd0e673c Enable lab media_pipelines in composed config and wire ac-ms-media-transcode. 
Overlay media pipeline PHP/JS/SQL on compose, nginx HLS location, enable
feature in lab config.php, and ensure media storage dirs on BE nodes.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-11 15:27:01 +02:00
Anton Afanasyeu
54174e7497 fix(cluster0): wire 2FA redirects, heartbeat session touch, TOTP reset script 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-11 14:48:27 +02:00
Anton Afanasyeu
a411dc5405 feat(cluster0): add Janus SFU deploy script and graph gzip smoke test 
deploy-janus-sfu.sh installs Janus on cast02, writes signaling config, and templates CAST02_IP into nginx; populate gains --phase sfu.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-10 22:12:02 +02:00
Anton Afanasyeu
dfe701f2de bump deps/ac-scripts for wireless ADB reconnect improvements 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-10 15:37:10 +02:00
Anton Afanasyeu
a14413e886 fix(cluster0): Gitea cluster proxy, 2FA seed, hub downloads nginx 
Bind Gitea on all interfaces for cast02/03 proxy, fix stale 2FA lab-seed
approve flow, add /v0/downloads/ and GITEA_UPSTREAM_HOST, and guard nginx
configure against empty templates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-10 15:36:49 +02:00
Anton Afanasyeu
970de79a90 Sync lab seeds with hub monitor link, 2FA copy, and nginx monitor route. 
Align cluster0 deploy seeds and apps-port80 vhost for Grafana monitoring path.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-08 14:56:15 +02:00
Anton Afanasyeu
0911d97fa9 fix(lab-seed): sync analytics.js consent gate for GA4 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-06 17:19:55 +02:00
Anton Afanasyeu
d045653a7b fix(monitoring): drop deprecated artc0 from cast04 scrape targets 
artc0 VM is off; remove node_exporter target and relabel rules from
Prometheus. Point Grafana auth-proxy whitelist and alert-notifier
shortener API at cast01–03 cluster instead of 10.7.16.128.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-06 17:05:55 +02:00
Anton Afanasyeu
c23ad5efdc fix(cluster0): HTTPS redirects behind TLS-terminating FE 
BE nginx used $scheme (http) in Location headers, downgrading browsers from
HTTPS to HTTP despite a valid cert on the FE. Honor X-Forwarded-Proto and
force https for public hostnames in all return/rewrite redirects.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-05 19:17:12 +02:00
Anton Afanasyeu
cf2e6ecb4e fix(cluster0): 2FA nginx routes and extend pending-2FA on poll 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-05 19:12:53 +02:00
Anton Afanasyeu
430457dcd9 fix(cluster0): redirect BE root / to hub over HTTPS 
FE proxies https://apps.f0xx.org/ to cast01 GET /; without this block the
Alpine default_server served the nginx welcome page. Absolute https redirect
avoids http:// in Location when upstream is plain :80.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-05 18:56:40 +02:00
Anton Afanasyeu
56a6cd785d fix(cluster0): preserve issues layout overlay and validate rsync deploy 
Compose ac-be-issues views last so tickets/graphs stubs no longer overwrite
the canonical nav shell (monitor link). validate-ac-repos accepts /mnt/repos/ac
lab checkout and unset url-shortener origin.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-05 18:28:46 +02:00
Anton Afanasyeu
4e885056e0 compose: builder config, two_factor.js sync, cluster bootstrap support 2026-07-05 16:57:37 +02:00
Anton Afanasyeu
e3ba73a607 fix configure-nginx: skip same-file install (script runs from git repo path) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-04 11:30:14 +02:00
Anton Afanasyeu
8dbfe5e321 fix deploy-ac-broadcast: source from monorepo NFS; remove broadcast from CORE subs 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-04 11:28:07 +02:00
Anton Afanasyeu
6c9402947f fix deploy-ac-broadcast: use mariadb -u root; add broadcast+sfu to CORE subs 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-04 11:26:06 +02:00
Anton Afanasyeu
46a7592164 monitoring: fix false HttpEndpointDown alert for self-signed FE cert 
- blackbox.yml: add http_2xx_insecure module (TLS skip) for FE probing
- prometheus.yml: split blackbox_http (internal HTTP) vs blackbox_https_external
  (external HTTPS targets using insecure module); remove notify.f0xx.org probe
  until FE nginx proxies it
- service_alerts.yml: HttpEndpointDown/SlowResponse cover both jobs via regex
- TODO: replace http_2xx_insecure with strict module once FE gets LE cert

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-03 14:12:02 +02:00
Anton Afanasyeu
3126bb4c76 nginx: sync config from git repo before install (prevents stale NFS override) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-28 23:12:04 +02:00
Anton Afanasyeu
36f5cdc003 nginx: add SFU signaling and Janus proxy locations to apps vhost 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-28 23:10:03 +02:00
Anton Afanasyeu
98f4ecc2c5 deploy: favicon, nuevo-player, ac-ms-broadcast, nginx notify/monitor/broadcast 
- favicon.ico (32px) + apple-touch-icon.ico (180px) added to composed backend seed
- layout.php: add <link rel="icon"> and <link rel="apple-touch-icon"> in <head>
- nuevo-player (Video.js + Nuevo licensed plugin) into assets/vendor/nuevo-player/
- THIRD_PARTY_LICENSES.md: add Nuevo Player (commercial) + TipTap (MIT) entries
- apps-port80.conf: full rewrite with all live fixes merged in:
    * map $http_upgrade $connection_upgrade (WebSocket upgrade)
    * 2FA location regex extended: api/two-factor
    * grafana-auth-check internal endpoint + @monitor_login_redirect
    * Grafana proxy (cast04:3000) + Alertmanager proxy (cast04:9093)
    * broadcast admin path /app/androidcast_project/broadcast/ (auth_request gated)
    * notify.f0xx.org server block: public /m/{slug} landing + API
    * favicon.ico at server root
- deploy-ac-broadcast.sh: new app-phase script (DB schema, user, worker, rsync)
- populate_lab_setup.sh: add deploy-ac-broadcast.sh to run_phase_app

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-28 22:55:44 +02:00
Anton Afanasyeu
b9925a6c74 deploy: pre-populate migration tracking for already-applied migrations 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-28 22:48:32 +02:00
Anton Afanasyeu
8359608ecd deploy: idempotent migrations with schema_migrations tracking table 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-28 22:47:04 +02:00
Anton Afanasyeu
9edcd44689 deploy: fix load-schemas paths; add 080_sfu_rooms migration 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-28 22:41:22 +02:00
Anton Afanasyeu
386f7ab793 monitoring: fix mysqld target to cast01, add external blackbox probe 
- Move mysqld_exporter target from artc0 (obsolete) to cast01:9104
- Add https://apps.f0xx.org/ as external blackbox HTTP probe
- Comment artc0 as legacy/monitoring-only node

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-28 22:34:12 +02:00
Anton Afanasyeu
2b2c32cff5 added 'monitoring' path - ask devs why it's there 2026-06-28 22:01:59 +02:00
Anton Afanasyeu
3c5233c903 feat(2fa): add cross-device approval routes to composed backend router 
- New routes: GET/POST /two-factor/approve, GET /api/two-factor/poll
- Nginx regex extended: (login|...|api/two-factor)(/|$)
- lab-seeds views/JS synced from ac-be-auth

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-27 22:49:59 +02:00
Anton Afanasyeu
fbefc98792 deploy: auto-install iptables + modprobe wg in deploy-remote-access-lab; DB_BACKEND in cluster.env 
- deploy-remote-access-lab.sh: install iptables via apk if missing; modprobe wireguard
- cluster.env: add DB_BACKEND=1 (MariaDB default; 2=Postgres, 3=SQLite)

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-25 17:48:51 +02:00
Anton Afanasyev
6c2403aae9 Cluster ops: tolerate hub platform stub; auto-clean dirty submodules. 
Add sync-cluster-scripts.sh for NFS /shared/cluster updates from /mnt/repos/ac.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-24 23:18:15 +02:00
Anton Afanasyev
4d2db29b8b Lab cluster: deploy WG/RSSH on cast01 + compose remote_access from secrets. 
Add deploy-remote-access-lab.sh, wire WG/RSSH into compose-lab-backend.php,
and run RA deploy during populate app phase on primary.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-24 22:57:28 +02:00
Anton Afanasyev
b47f91b1ab Cluster deploy: ac/* only, hub assets, auth routes at project root. 
Remove monolith clone path; add hub deploy, legacy purge, composed-backend
login/logout nginx locations, and full hub asset rsync validation.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-24 22:53:38 +02:00
Anton Afanasyev
76d4797cac cluster: fix url-shortener nginx fastcgi routing for s.f0xx.org 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-24 17:50:43 +02:00
Anton Afanasyev
2f544de974 cluster: nginx vhost for s.f0xx.org on cast01; drop artc0 comment 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-24 17:49:36 +02:00
Anton Afanasyeu
70b886aecb cluster: url-shortener API via cast01; mark artc0 deprecated 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-24 17:45:12 +02:00
Anton Afanasyeu
e4e3cd3462 deps: ac-scripts under deps/; cluster upstream in lab apps.conf seed 
Move ac-scripts submodule to deps/ac-scripts. FE apps.conf seed proxies to
ac_be_backend (cast01–03) instead of artc0.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-24 17:45:04 +02:00
Anton Afanasyeu
07cbaceb7f deps: move ac-scripts submodule to deps/ac-scripts 
Remove legacy ac-scripts/ path; internal deps live under deps/ per repo policy.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-24 17:44:29 +02:00
Anton Afanasyeu
b68dd00527 cluster0: lab verify-email short links via prod s.f0xx.org API 
Lab MariaDB slugs are not on public s.f0xx.org; outbound mail calls prod
shorten API (internal artc0 + Host header) with API bearer token in secrets.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 22:37:55 +02:00
Anton Afanasyeu
560e4e12b2 cluster0: sync lab-seed AuthMailer with inline CID QR for verify email 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 21:34:04 +02:00
Anton Afanasyeu
5b16848366 cluster0: fix secrets MAIL_FROM parsing; normalize RFC5322 From in compose 
load_secrets_lab quotes values safely; compose reads MAIL_FROM via read_secret.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 20:14:27 +02:00