fe: acl0 lab vhost, cluster upstream, INSTALL smoke checklist

Add ac-fe.conf and ac-fe.fragment for Gentoo FE proxy to cast cluster;
upstream uses cast01 primary with cast02/03 backup; document PO install steps.

Co-authored-by: Cursor <cursoragent@cursor.com>

fe/INSTALL.md

@@ -0,0 +1,60 @@
+# FE install — Gentoo (`monstro`)
+
+Repo paths: `fe/ac-fe.conf`, `fe/ac-fe.fragment`  
+Install as: `/etc/nginx/ac-fe.conf`, `/etc/nginx/ac-fe.fragment`
+
+## Lab cluster (`acl0.f0xx.org`)
+
+1. **DNS** — `acl0.f0xx.org` and `c1`–`c3.acl0.f0xx.org` → monstro (same as `apps.f0xx.org` FE).
+2. **TLS** — issue cert (example):
+   ```bash
+   certbot certonly --nginx \
+     -d acl0.f0xx.org -d c1.acl0.f0xx.org -d c2.acl0.f0xx.org -d c3.acl0.f0xx.org
+   ```
+3. **Copy configs** from `ac-platform-edge` checkout:
+   ```bash
+   cp fe/ac-fe.conf fe/ac-fe.fragment /etc/nginx/
+   ```
+4. **Upstream** — default in `ac-fe.conf` is lab:
+   `cast01.intra.raptor.org:80` (`FE_PROXY_TARGET` in `ac-deploy/sim/cluster0/cluster.env`).
+5. **Enable** — in `/etc/nginx/nginx.conf` (`http {}`), after `include /etc/nginx/apps.conf;`:
+   ```nginx
+   include /etc/nginx/ac-fe.conf;
+   ```
+6. **Reload** — `nginx -t && rc-service nginx reload`
+7. **Smoke** (from any host with DNS to monstro):
+
+```bash
+curl -sI https://acl0.f0xx.org/app/androidcast_project/issues/ | head -5
+curl -sI https://acl0.f0xx.org/app/androidcast_project/crashes/ | head -5   # expect 301 → /issues/
+curl -sI https://acl0.f0xx.org/app/androidcast_project/git/ | head -5
+curl -sS https://acl0.f0xx.org/app/androidcast_project/issues/api/diag.php | head -c 200
+```
+
+8. **Cluster verify** (on cast01 after FE is live):
+
+```bash
+sudo sh /shared/cluster/verify_global_setup.sh
+```
+
+`apps.f0xx.org` is **unchanged** until you edit `apps.conf` (prod still proxies `/crashes/` to artc0).
+
+## Prod cutover (`apps.f0xx.org` → `/issues/`)
+
+When artc0 BE serves `/issues/` (or you proxy prod to cluster):
+
+1. In `ac-fe.conf`, point `upstream ac_be_backend` at `artc0.intra.raptor.org:80` (or keep cluster for staged test).
+2. In `/etc/nginx/apps.conf`, inside the `server { listen 443 … apps.f0xx.org; }` block:
+   - Comment out the old `location ^~ /app/androidcast_project/crashes/` proxy block.
+   - Add: `include /etc/nginx/ac-fe.fragment;`
+3. `nginx -t && rc-service nginx reload`
+4. Verify: `curl -sI https://apps.f0xx.org/app/androidcast_project/crashes/` → `301` → `/issues/`
+
+## Files
+
+| File | Role |
+|------|------|
+| `ac-fe.conf` | `upstream ac_be_backend` + full `acl0.*` vhost (proxy to cluster) |
+| `ac-fe.fragment` | `/issues/` proxy + `/crashes/` → 301; include inside `apps.f0xx.org` server when ready |
+
+Do **not** edit `apps.conf` in git — maintain FE snippets here; PO applies on monstro.