fe: acl0 lab vhost, cluster upstream, INSTALL smoke checklist

Add ac-fe.conf and ac-fe.fragment for Gentoo FE proxy to cast cluster; upstream uses cast01 primary with cast02/03 backup; document PO install steps. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-29 00:59:30 +03:00 · 2026-06-23 17:07:35 +02:00
parent 533c297228
commit 3836763f13
4 changed files with 217 additions and 1 deletions
--- a/README.md
+++ b/README.md
@@ -1,5 +1,12 @@
 # ac-platform-edge

-Nginx route fragments for apps.f0xx.org.
+Nginx route fragments for `apps.f0xx.org` and lab FE (`acl0.f0xx.org`).
+
+| Path | Purpose |
+|------|---------|
+| `fe/ac-fe.conf` | Gentoo FE install → `/etc/nginx/ac-fe.conf` (lab vhost + upstream) |
+| `fe/ac-fe.fragment` | `/issues/` + legacy `/crashes/` redirect; include in prod `apps.conf` when ready |
+| `fe/INSTALL.md` | PO steps (copy, certbot, `nginx.conf` include, reload) |
+| `fragments/crash_reporter/` | BE-side / legacy snippets |

 Remote: `git://f0xx.org/ac/ac-platform-edge`
--- a/fe/INSTALL.md
+++ b/fe/INSTALL.md
@@ -0,0 +1,60 @@
+# FE install — Gentoo (`monstro`)
+
+Repo paths: `fe/ac-fe.conf`, `fe/ac-fe.fragment`  
+Install as: `/etc/nginx/ac-fe.conf`, `/etc/nginx/ac-fe.fragment`
+
+## Lab cluster (`acl0.f0xx.org`)
+
+1. **DNS** — `acl0.f0xx.org` and `c1`–`c3.acl0.f0xx.org` → monstro (same as `apps.f0xx.org` FE).
+2. **TLS** — issue cert (example):
+   ```bash
+   certbot certonly --nginx \
+     -d acl0.f0xx.org -d c1.acl0.f0xx.org -d c2.acl0.f0xx.org -d c3.acl0.f0xx.org
+   ```
+3. **Copy configs** from `ac-platform-edge` checkout:
+   ```bash
+   cp fe/ac-fe.conf fe/ac-fe.fragment /etc/nginx/
+   ```
+4. **Upstream** — default in `ac-fe.conf` is lab:
+   `cast01.intra.raptor.org:80` (`FE_PROXY_TARGET` in `ac-deploy/sim/cluster0/cluster.env`).
+5. **Enable** — in `/etc/nginx/nginx.conf` (`http {}`), after `include /etc/nginx/apps.conf;`:
+   ```nginx
+   include /etc/nginx/ac-fe.conf;
+   ```
+6. **Reload** — `nginx -t && rc-service nginx reload`
+7. **Smoke** (from any host with DNS to monstro):
+
+```bash
+curl -sI https://acl0.f0xx.org/app/androidcast_project/issues/ | head -5
+curl -sI https://acl0.f0xx.org/app/androidcast_project/crashes/ | head -5   # expect 301 → /issues/
+curl -sI https://acl0.f0xx.org/app/androidcast_project/git/ | head -5
+curl -sS https://acl0.f0xx.org/app/androidcast_project/issues/api/diag.php | head -c 200
+```
+
+8. **Cluster verify** (on cast01 after FE is live):
+
+```bash
+sudo sh /shared/cluster/verify_global_setup.sh
+```
+
+`apps.f0xx.org` is **unchanged** until you edit `apps.conf` (prod still proxies `/crashes/` to artc0).
+
+## Prod cutover (`apps.f0xx.org` → `/issues/`)
+
+When artc0 BE serves `/issues/` (or you proxy prod to cluster):
+
+1. In `ac-fe.conf`, point `upstream ac_be_backend` at `artc0.intra.raptor.org:80` (or keep cluster for staged test).
+2. In `/etc/nginx/apps.conf`, inside the `server { listen 443 … apps.f0xx.org; }` block:
+   - Comment out the old `location ^~ /app/androidcast_project/crashes/` proxy block.
+   - Add: `include /etc/nginx/ac-fe.fragment;`
+3. `nginx -t && rc-service nginx reload`
+4. Verify: `curl -sI https://apps.f0xx.org/app/androidcast_project/crashes/` → `301` → `/issues/`
+
+## Files
+
+| File | Role |
+|------|------|
+| `ac-fe.conf` | `upstream ac_be_backend` + full `acl0.*` vhost (proxy to cluster) |
+| `ac-fe.fragment` | `/issues/` proxy + `/crashes/` → 301; include inside `apps.f0xx.org` server when ready |
+
+Do **not** edit `apps.conf` in git — maintain FE snippets here; PO applies on monstro.
--- a/fe/ac-fe.conf
+++ b/fe/ac-fe.conf
@@ -0,0 +1,122 @@
+# Android Cast FE — lab cluster + optional prod upstream switch.
+# Target install on Gentoo FE (monstro):  /etc/nginx/ac-fe.conf
+# Enable: add to /etc/nginx/nginx.conf (http {}), after apps.conf:
+#   include /etc/nginx/ac-fe.conf;
+#
+# Reload:  nginx -t && rc-service nginx reload
+#
+# Upstream: lab = cast01 cluster nginx :80; prod = artc0 BE :80.
+# Edit ac_be_backend below before reload when cutting prod apps.f0xx.org to /issues/.
+
+upstream ac_be_backend {
+	server cast01.intra.raptor.org:80;
+	server cast02.intra.raptor.org:80 backup;
+	server cast03.intra.raptor.org:80 backup;
+	# server artc0.intra.raptor.org:80;   # prod cutover — uncomment and comment lab lines
+	keepalive 8;
+}
+
+# --- Lab public names (DNS → monstro FE → cluster BE) ---
+# cluster.env: acl0.f0xx.org, c1–c3.acl0.f0xx.org
+
+server {
+	listen 80;
+	server_name acl0.f0xx.org c1.acl0.f0xx.org c2.acl0.f0xx.org c3.acl0.f0xx.org;
+	return 301 https://$host$request_uri;
+}
+
+server {
+	listen 443 ssl http2;
+	server_name acl0.f0xx.org c1.acl0.f0xx.org c2.acl0.f0xx.org c3.acl0.f0xx.org;
+
+	access_log /var/log/nginx/acl0.f0xx.org.access_log main;
+	error_log /var/log/nginx/acl0.f0xx.org.error_log info;
+
+	# Issue cert first:  certbot certonly --nginx -d acl0.f0xx.org -d c1.acl0.f0xx.org ...
+	ssl_certificate /etc/letsencrypt/live/acl0.f0xx.org/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/acl0.f0xx.org/privkey.pem;
+
+	location ^~ /v0/ota/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	location = /app/androidcast_project/build {
+		return 301 $scheme://$host/app/androidcast_project/build/;
+	}
+	location ^~ /app/androidcast_project/build/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_read_timeout 1800s;
+		proxy_send_timeout 1800s;
+		client_max_body_size 512m;
+	}
+
+	include /etc/nginx/ac-fe.fragment;
+
+	location = /app/androidcast_project/graphs {
+		return 301 $scheme://$host/app/androidcast_project/graphs/;
+	}
+	location ^~ /app/androidcast_project/graphs/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	location = /app/androidcast_project {
+		return 301 $scheme://$host/app/androidcast_project/;
+	}
+	location ^~ /app/androidcast_project/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	location = /app/androidcast_project/git {
+		return 301 $scheme://$host/app/androidcast_project/git/;
+	}
+	location ^~ /app/androidcast_project/git/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_read_timeout 1800s;
+		proxy_send_timeout 1800s;
+		client_max_body_size 512m;
+	}
+
+	location / {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	location ~ /\.ht {
+		deny all;
+	}
+}
--- a/fe/ac-fe.fragment
+++ b/fe/ac-fe.fragment
@@ -0,0 +1,27 @@
+# Paste into the listen 443 server {} for apps.f0xx.org (or lab acl0 vhost in ac-fe.conf).
+# Requires upstream ac_be_backend in http {} — defined at top of ac-fe.conf.
+#
+# When enabling on prod: comment out the old blocks in /etc/nginx/apps.conf for
+#   /app/androidcast_project/crashes and /crashes/ (keep graphs/build/hub as-is until cutover).
+
+	# --- Issues / ticket console (SPEC: /issues/ is canonical) ---
+	location = /app/androidcast_project/issues {
+		return 301 $scheme://$host/app/androidcast_project/issues/;
+	}
+	location ^~ /app/androidcast_project/issues/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		client_max_body_size 16m;
+	}
+
+	# --- Legacy /crashes/ → /issues/ (SPEC §7) ---
+	location = /app/androidcast_project/crashes {
+		return 301 $scheme://$host/app/androidcast_project/issues/;
+	}
+	location ^~ /app/androidcast_project/crashes/ {
+		rewrite ^/app/androidcast_project/crashes/?(.*)$ $scheme://$host/app/androidcast_project/issues/$1 permanent;
+	}