# FE install — Gentoo (`monstro`)

Repo paths: `fe/ac-fe.conf`, `fe/ac-fe.fragment`  
Install as: `/etc/nginx/ac-fe.conf`, `/etc/nginx/ac-fe.fragment`

## Lab cluster (`acl0.f0xx.org`)

1. **DNS** — `acl0.f0xx.org` and `c1`–`c3.acl0.f0xx.org` → monstro (same as `apps.f0xx.org` FE).
2. **TLS** — issue cert (example):
   ```bash
   certbot certonly --nginx \
     -d acl0.f0xx.org -d c1.acl0.f0xx.org -d c2.acl0.f0xx.org -d c3.acl0.f0xx.org
   ```
3. **Copy configs** from `ac-platform-edge` checkout:
   ```bash
   cp fe/ac-fe.conf fe/ac-fe.fragment /etc/nginx/
   ```
4. **Upstream** — default in `ac-fe.conf` is lab:
   `cast01.intra.raptor.org:80` (`FE_PROXY_TARGET` in `ac-deploy/sim/cluster0/cluster.env`).
5. **Enable** — in `/etc/nginx/nginx.conf` (`http {}`), after `include /etc/nginx/apps.conf;`:
   ```nginx
   include /etc/nginx/ac-fe.conf;
   ```
6. **Reload** — `nginx -t && rc-service nginx reload`
7. **Smoke** (from any host with DNS to monstro):

```bash
curl -sI https://acl0.f0xx.org/app/androidcast_project/issues/ | head -5
curl -sI https://acl0.f0xx.org/app/androidcast_project/crashes/ | head -5   # expect 301 → /issues/
curl -sI https://acl0.f0xx.org/app/androidcast_project/git/ | head -5
curl -sS https://acl0.f0xx.org/app/androidcast_project/issues/api/diag.php | head -c 200
```

8. **Cluster verify** (on cast01 after FE is live):

```bash
sudo sh /shared/cluster/verify_global_setup.sh
```

`apps.f0xx.org` is **unchanged** until you edit `apps.conf` (prod still proxies `/crashes/` to artc0).

## Prod cutover (`apps.f0xx.org` → `/issues/`)

When artc0 BE serves `/issues/` (or you proxy prod to cluster):

1. In `ac-fe.conf`, point `upstream ac_be_backend` at `artc0.intra.raptor.org:80` (or keep cluster for staged test).
2. In `/etc/nginx/apps.conf`, inside the `server { listen 443 … apps.f0xx.org; }` block:
   - Comment out the old `location ^~ /app/androidcast_project/crashes/` proxy block.
   - Add: `include /etc/nginx/ac-fe.fragment;`
3. `nginx -t && rc-service nginx reload`
4. Verify: `curl -sI https://apps.f0xx.org/app/androidcast_project/crashes/` → `301` → `/issues/`

## Files

| File | Role |
|------|------|
| `ac-fe.conf` | `upstream ac_be_backend` + full `acl0.*` vhost (proxy to cluster) |
| `ac-fe.fragment` | `/issues/` proxy + `/crashes/` → 301; include inside `apps.f0xx.org` server when ready |

Do **not** edit `apps.conf` in git — maintain FE snippets here; PO applies on monstro.

## TLS renew + smoke

Script: `fe/ac-certbot-renew-smoke.sh` — `certbot renew` (or `--dry-run`) then HTTPS checks for `apps.f0xx.org`, `acl0.f0xx.org`, `s.f0xx.org`.

```bash
sudo fe/ac-certbot-renew-smoke.sh --dry-run   # safe rehearsal
sudo fe/ac-certbot-renew-smoke.sh             # renew + reload nginx if certs changed
```

Optional cron on monstro: `0 4 * * * root /var/www/.../ac-platform-edge/fe/ac-certbot-renew-smoke.sh --quiet`

| Host | Cert path (live) |
|------|------------------|
| `apps.f0xx.org` | `/etc/letsencrypt/live/apps.f0xx.org/` |
| `acl0.f0xx.org` | `/etc/letsencrypt/live/acl0.f0xx.org/` (apex; `c1`–`c3` have separate certs today) |
| `s.f0xx.org` | `/etc/letsencrypt/live/s.f0xx.org/` — enable `include /etc/nginx/s.f0xx.org.conf;` in `nginx.conf` |

Shortener FE snippet: symlink `s.f0xx.org.conf` → `ac-ms-url-shortener/deploy/nginx.fe-s.f0xx.org.snippet`.