From 3836763f139f2e1cfa4d62fe93a8f5eb398ad0cc Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Tue, 23 Jun 2026 17:07:35 +0200 Subject: [PATCH] fe: acl0 lab vhost, cluster upstream, INSTALL smoke checklist Add ac-fe.conf and ac-fe.fragment for Gentoo FE proxy to cast cluster; upstream uses cast01 primary with cast02/03 backup; document PO install steps. Co-authored-by: Cursor --- README.md | 9 +++- fe/INSTALL.md | 60 +++++++++++++++++++++++ fe/ac-fe.conf | 122 ++++++++++++++++++++++++++++++++++++++++++++++ fe/ac-fe.fragment | 27 ++++++++++ 4 files changed, 217 insertions(+), 1 deletion(-) create mode 100644 fe/INSTALL.md create mode 100644 fe/ac-fe.conf create mode 100644 fe/ac-fe.fragment diff --git a/README.md b/README.md index 5c006f8..6d55381 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,12 @@ # ac-platform-edge -Nginx route fragments for apps.f0xx.org. +Nginx route fragments for `apps.f0xx.org` and lab FE (`acl0.f0xx.org`). + +| Path | Purpose | +|------|---------| +| `fe/ac-fe.conf` | Gentoo FE install → `/etc/nginx/ac-fe.conf` (lab vhost + upstream) | +| `fe/ac-fe.fragment` | `/issues/` + legacy `/crashes/` redirect; include in prod `apps.conf` when ready | +| `fe/INSTALL.md` | PO steps (copy, certbot, `nginx.conf` include, reload) | +| `fragments/crash_reporter/` | BE-side / legacy snippets | Remote: `git://f0xx.org/ac/ac-platform-edge` diff --git a/fe/INSTALL.md b/fe/INSTALL.md new file mode 100644 index 0000000..e859643 --- /dev/null +++ b/fe/INSTALL.md @@ -0,0 +1,60 @@ +# FE install — Gentoo (`monstro`) + +Repo paths: `fe/ac-fe.conf`, `fe/ac-fe.fragment` +Install as: `/etc/nginx/ac-fe.conf`, `/etc/nginx/ac-fe.fragment` + +## Lab cluster (`acl0.f0xx.org`) + +1. **DNS** — `acl0.f0xx.org` and `c1`–`c3.acl0.f0xx.org` → monstro (same as `apps.f0xx.org` FE). +2. **TLS** — issue cert (example): + ```bash + certbot certonly --nginx \ + -d acl0.f0xx.org -d c1.acl0.f0xx.org -d c2.acl0.f0xx.org -d c3.acl0.f0xx.org + ``` +3. **Copy configs** from `ac-platform-edge` checkout: + ```bash + cp fe/ac-fe.conf fe/ac-fe.fragment /etc/nginx/ + ``` +4. **Upstream** — default in `ac-fe.conf` is lab: + `cast01.intra.raptor.org:80` (`FE_PROXY_TARGET` in `ac-deploy/sim/cluster0/cluster.env`). +5. **Enable** — in `/etc/nginx/nginx.conf` (`http {}`), after `include /etc/nginx/apps.conf;`: + ```nginx + include /etc/nginx/ac-fe.conf; + ``` +6. **Reload** — `nginx -t && rc-service nginx reload` +7. **Smoke** (from any host with DNS to monstro): + +```bash +curl -sI https://acl0.f0xx.org/app/androidcast_project/issues/ | head -5 +curl -sI https://acl0.f0xx.org/app/androidcast_project/crashes/ | head -5 # expect 301 → /issues/ +curl -sI https://acl0.f0xx.org/app/androidcast_project/git/ | head -5 +curl -sS https://acl0.f0xx.org/app/androidcast_project/issues/api/diag.php | head -c 200 +``` + +8. **Cluster verify** (on cast01 after FE is live): + +```bash +sudo sh /shared/cluster/verify_global_setup.sh +``` + +`apps.f0xx.org` is **unchanged** until you edit `apps.conf` (prod still proxies `/crashes/` to artc0). + +## Prod cutover (`apps.f0xx.org` → `/issues/`) + +When artc0 BE serves `/issues/` (or you proxy prod to cluster): + +1. In `ac-fe.conf`, point `upstream ac_be_backend` at `artc0.intra.raptor.org:80` (or keep cluster for staged test). +2. In `/etc/nginx/apps.conf`, inside the `server { listen 443 … apps.f0xx.org; }` block: + - Comment out the old `location ^~ /app/androidcast_project/crashes/` proxy block. + - Add: `include /etc/nginx/ac-fe.fragment;` +3. `nginx -t && rc-service nginx reload` +4. Verify: `curl -sI https://apps.f0xx.org/app/androidcast_project/crashes/` → `301` → `/issues/` + +## Files + +| File | Role | +|------|------| +| `ac-fe.conf` | `upstream ac_be_backend` + full `acl0.*` vhost (proxy to cluster) | +| `ac-fe.fragment` | `/issues/` proxy + `/crashes/` → 301; include inside `apps.f0xx.org` server when ready | + +Do **not** edit `apps.conf` in git — maintain FE snippets here; PO applies on monstro. diff --git a/fe/ac-fe.conf b/fe/ac-fe.conf new file mode 100644 index 0000000..37f54d5 --- /dev/null +++ b/fe/ac-fe.conf @@ -0,0 +1,122 @@ +# Android Cast FE — lab cluster + optional prod upstream switch. +# Target install on Gentoo FE (monstro): /etc/nginx/ac-fe.conf +# Enable: add to /etc/nginx/nginx.conf (http {}), after apps.conf: +# include /etc/nginx/ac-fe.conf; +# +# Reload: nginx -t && rc-service nginx reload +# +# Upstream: lab = cast01 cluster nginx :80; prod = artc0 BE :80. +# Edit ac_be_backend below before reload when cutting prod apps.f0xx.org to /issues/. + +upstream ac_be_backend { + server cast01.intra.raptor.org:80; + server cast02.intra.raptor.org:80 backup; + server cast03.intra.raptor.org:80 backup; + # server artc0.intra.raptor.org:80; # prod cutover — uncomment and comment lab lines + keepalive 8; +} + +# --- Lab public names (DNS → monstro FE → cluster BE) --- +# cluster.env: acl0.f0xx.org, c1–c3.acl0.f0xx.org + +server { + listen 80; + server_name acl0.f0xx.org c1.acl0.f0xx.org c2.acl0.f0xx.org c3.acl0.f0xx.org; + return 301 https://$host$request_uri; +} + +server { + listen 443 ssl http2; + server_name acl0.f0xx.org c1.acl0.f0xx.org c2.acl0.f0xx.org c3.acl0.f0xx.org; + + access_log /var/log/nginx/acl0.f0xx.org.access_log main; + error_log /var/log/nginx/acl0.f0xx.org.error_log info; + + # Issue cert first: certbot certonly --nginx -d acl0.f0xx.org -d c1.acl0.f0xx.org ... + ssl_certificate /etc/letsencrypt/live/acl0.f0xx.org/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/acl0.f0xx.org/privkey.pem; + + location ^~ /v0/ota/ { + proxy_pass http://ac_be_backend; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + location = /app/androidcast_project/build { + return 301 $scheme://$host/app/androidcast_project/build/; + } + location ^~ /app/androidcast_project/build/ { + proxy_pass http://ac_be_backend; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_read_timeout 1800s; + proxy_send_timeout 1800s; + client_max_body_size 512m; + } + + include /etc/nginx/ac-fe.fragment; + + location = /app/androidcast_project/graphs { + return 301 $scheme://$host/app/androidcast_project/graphs/; + } + location ^~ /app/androidcast_project/graphs/ { + proxy_pass http://ac_be_backend; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + location = /app/androidcast_project { + return 301 $scheme://$host/app/androidcast_project/; + } + location ^~ /app/androidcast_project/ { + proxy_pass http://ac_be_backend; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + location = /app/androidcast_project/git { + return 301 $scheme://$host/app/androidcast_project/git/; + } + location ^~ /app/androidcast_project/git/ { + proxy_pass http://ac_be_backend; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_read_timeout 1800s; + proxy_send_timeout 1800s; + client_max_body_size 512m; + } + + location / { + proxy_pass http://ac_be_backend; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + location ~ /\.ht { + deny all; + } +} diff --git a/fe/ac-fe.fragment b/fe/ac-fe.fragment new file mode 100644 index 0000000..29dce05 --- /dev/null +++ b/fe/ac-fe.fragment @@ -0,0 +1,27 @@ +# Paste into the listen 443 server {} for apps.f0xx.org (or lab acl0 vhost in ac-fe.conf). +# Requires upstream ac_be_backend in http {} — defined at top of ac-fe.conf. +# +# When enabling on prod: comment out the old blocks in /etc/nginx/apps.conf for +# /app/androidcast_project/crashes and /crashes/ (keep graphs/build/hub as-is until cutover). + + # --- Issues / ticket console (SPEC: /issues/ is canonical) --- + location = /app/androidcast_project/issues { + return 301 $scheme://$host/app/androidcast_project/issues/; + } + location ^~ /app/androidcast_project/issues/ { + proxy_pass http://ac_be_backend; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + client_max_body_size 16m; + } + + # --- Legacy /crashes/ → /issues/ (SPEC §7) --- + location = /app/androidcast_project/crashes { + return 301 $scheme://$host/app/androidcast_project/issues/; + } + location ^~ /app/androidcast_project/crashes/ { + rewrite ^/app/androidcast_project/crashes/?(.*)$ $scheme://$host/app/androidcast_project/issues/$1 permanent; + }