ac-platform-edge/fe/INSTALL.md

FE install — Gentoo (monstro)

Repo paths: fe/ac-fe.conf, fe/ac-fe.fragment
Install as: /etc/nginx/ac-fe.conf, /etc/nginx/ac-fe.fragment

Lab cluster (acl0.f0xx.org)

1. DNS — acl0.f0xx.org and c1–c3.acl0.f0xx.org → monstro (same as apps.f0xx.org FE).
2. TLS — issue cert (example):

   certbot certonly --nginx \
     -d acl0.f0xx.org -d c1.acl0.f0xx.org -d c2.acl0.f0xx.org -d c3.acl0.f0xx.org
   

3. Copy configs from ac-platform-edge checkout:

   cp fe/ac-fe.conf fe/ac-fe.fragment /etc/nginx/
   

4. Upstream — default in ac-fe.conf is lab: cast01.intra.raptor.org:80 (FE_PROXY_TARGET in ac-deploy/sim/cluster0/cluster.env).
5. Enable — in /etc/nginx/nginx.conf (http {}), after include /etc/nginx/apps.conf;:

   include /etc/nginx/ac-fe.conf;
   

6. Reload — nginx -t && rc-service nginx reload
7. Smoke (from any host with DNS to monstro):

curl -sI https://acl0.f0xx.org/app/androidcast_project/issues/ | head -5
curl -sI https://acl0.f0xx.org/app/androidcast_project/crashes/ | head -5   # expect 301 → /issues/
curl -sI https://acl0.f0xx.org/app/androidcast_project/git/ | head -5
curl -sS https://acl0.f0xx.org/app/androidcast_project/issues/api/diag.php | head -c 200

8. Cluster verify (on cast01 after FE is live):

sudo sh /shared/cluster/verify_global_setup.sh

apps.f0xx.org is unchanged until you edit apps.conf (prod still proxies /crashes/ to artc0).

Prod cutover (apps.f0xx.org → /issues/)

When artc0 BE serves /issues/ (or you proxy prod to cluster):

1. In ac-fe.conf, point upstream ac_be_backend at artc0.intra.raptor.org:80 (or keep cluster for staged test).
2. In /etc/nginx/apps.conf, inside the server { listen 443 … apps.f0xx.org; } block:
   • Comment out the old location ^~ /app/androidcast_project/crashes/ proxy block.
   • Add: include /etc/nginx/ac-fe.fragment;
3. nginx -t && rc-service nginx reload
4. Verify: curl -sI https://apps.f0xx.org/app/androidcast_project/crashes/ → 301 → /issues/

Files

File	Role
ac-fe.conf	upstream ac_be_backend + full acl0.* vhost (proxy to cluster)
ac-fe.fragment	/issues/ proxy + /crashes/ → 301; include inside apps.f0xx.org server when ready

Do not edit apps.conf in git — maintain FE snippets here; PO applies on monstro.

TLS renew + smoke

Script: fe/ac-certbot-renew-smoke.sh — certbot renew (or --dry-run) then HTTPS checks for apps.f0xx.org, acl0.f0xx.org, s.f0xx.org.

sudo fe/ac-certbot-renew-smoke.sh --dry-run   # safe rehearsal
sudo fe/ac-certbot-renew-smoke.sh             # renew + reload nginx if certs changed

Optional cron on monstro: 0 4 * * * root /var/www/.../ac-platform-edge/fe/ac-certbot-renew-smoke.sh --quiet

Host	Cert path (live)
apps.f0xx.org	/etc/letsencrypt/live/apps.f0xx.org/
acl0.f0xx.org	/etc/letsencrypt/live/acl0.f0xx.org/ (apex; c1–c3 have separate certs today)
s.f0xx.org	/etc/letsencrypt/live/s.f0xx.org/ — enable include /etc/nginx/s.f0xx.org.conf; in nginx.conf

Shortener FE snippet: symlink s.f0xx.org.conf → ac-ms-url-shortener/deploy/nginx.fe-s.f0xx.org.snippet.