mirror of
git://f0xx.org/ac/ac-platform-edge
synced 2026-07-29 05:19:09 +03:00
81 lines
3.3 KiB
Markdown
81 lines
3.3 KiB
Markdown
# FE install — Gentoo (`monstro`)
|
||
|
||
Repo paths: `fe/ac-fe.conf`, `fe/ac-fe.fragment`
|
||
Install as: `/etc/nginx/ac-fe.conf`, `/etc/nginx/ac-fe.fragment`
|
||
|
||
## Lab cluster (`acl0.f0xx.org`)
|
||
|
||
1. **DNS** — `acl0.f0xx.org` and `c1`–`c3.acl0.f0xx.org` → monstro (same as `apps.f0xx.org` FE).
|
||
2. **TLS** — issue cert (example):
|
||
```bash
|
||
certbot certonly --nginx \
|
||
-d acl0.f0xx.org -d c1.acl0.f0xx.org -d c2.acl0.f0xx.org -d c3.acl0.f0xx.org
|
||
```
|
||
3. **Copy configs** from `ac-platform-edge` checkout:
|
||
```bash
|
||
cp fe/ac-fe.conf fe/ac-fe.fragment /etc/nginx/
|
||
```
|
||
4. **Upstream** — default in `ac-fe.conf` is lab:
|
||
`cast01.intra.raptor.org:80` (`FE_PROXY_TARGET` in `ac-deploy/sim/cluster0/cluster.env`).
|
||
5. **Enable** — in `/etc/nginx/nginx.conf` (`http {}`), after `include /etc/nginx/apps.conf;`:
|
||
```nginx
|
||
include /etc/nginx/ac-fe.conf;
|
||
```
|
||
6. **Reload** — `nginx -t && rc-service nginx reload`
|
||
7. **Smoke** (from any host with DNS to monstro):
|
||
|
||
```bash
|
||
curl -sI https://acl0.f0xx.org/app/androidcast_project/issues/ | head -5
|
||
curl -sI https://acl0.f0xx.org/app/androidcast_project/crashes/ | head -5 # expect 301 → /issues/
|
||
curl -sI https://acl0.f0xx.org/app/androidcast_project/git/ | head -5
|
||
curl -sS https://acl0.f0xx.org/app/androidcast_project/issues/api/diag.php | head -c 200
|
||
```
|
||
|
||
8. **Cluster verify** (on cast01 after FE is live):
|
||
|
||
```bash
|
||
sudo sh /shared/cluster/verify_global_setup.sh
|
||
```
|
||
|
||
`apps.f0xx.org` is **unchanged** until you edit `apps.conf` (prod still proxies `/crashes/` to artc0).
|
||
|
||
## Prod cutover (`apps.f0xx.org` → `/issues/`)
|
||
|
||
When artc0 BE serves `/issues/` (or you proxy prod to cluster):
|
||
|
||
1. In `ac-fe.conf`, point `upstream ac_be_backend` at `artc0.intra.raptor.org:80` (or keep cluster for staged test).
|
||
2. In `/etc/nginx/apps.conf`, inside the `server { listen 443 … apps.f0xx.org; }` block:
|
||
- Comment out the old `location ^~ /app/androidcast_project/crashes/` proxy block.
|
||
- Add: `include /etc/nginx/ac-fe.fragment;`
|
||
3. `nginx -t && rc-service nginx reload`
|
||
4. Verify: `curl -sI https://apps.f0xx.org/app/androidcast_project/crashes/` → `301` → `/issues/`
|
||
|
||
## Files
|
||
|
||
| File | Role |
|
||
|------|------|
|
||
| `ac-fe.conf` | `upstream ac_be_backend` + full `acl0.*` vhost (proxy to cluster) |
|
||
| `ac-fe.fragment` | `/issues/` proxy + `/crashes/` → 301; include inside `apps.f0xx.org` server when ready |
|
||
|
||
Do **not** edit `apps.conf` in git — maintain FE snippets here; PO applies on monstro.
|
||
|
||
## TLS renew + smoke
|
||
|
||
Script: `fe/ac-certbot-renew-smoke.sh` — `certbot renew` (or `--dry-run`) then HTTPS checks for `apps.f0xx.org`, `acl0.f0xx.org`, `s.f0xx.org`.
|
||
|
||
```bash
|
||
sudo fe/ac-certbot-renew-smoke.sh --dry-run # safe rehearsal
|
||
sudo fe/ac-certbot-renew-smoke.sh # renew + reload nginx if certs changed
|
||
```
|
||
|
||
Optional cron on monstro: `0 4 * * * root /var/www/.../ac-platform-edge/fe/ac-certbot-renew-smoke.sh --quiet`
|
||
|
||
| Host | Cert path (live) |
|
||
|------|------------------|
|
||
| `apps.f0xx.org` | `/etc/letsencrypt/live/apps.f0xx.org/` |
|
||
| `acl0.f0xx.org` | `/etc/letsencrypt/live/acl0.f0xx.org/` (apex; `c1`–`c3` have separate certs today) |
|
||
| `s.f0xx.org` | `/etc/letsencrypt/live/s.f0xx.org/` — enable `include /etc/nginx/s.f0xx.org.conf;` in `nginx.conf` |
|
||
|
||
Shortener FE snippet: symlink `s.f0xx.org.conf` → `ac-ms-url-shortener/deploy/nginx.fe-s.f0xx.org.snippet`.
|
||
|