From 9dfe9a6c1c51ee028c9451aaa1e3ba37f48b87b1 Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Wed, 10 Jun 2026 14:28:49 +0200 Subject: [PATCH] sync --- docs/INFRA.md | 1 + docs/OTA.md | 1 + .../backend/nginx.fe-apps.f0xx.org.snippet | 13 +---- .../backend/nginx.fe-ota.snippet | 13 +++++ .../backend/scripts/install-fe-ota-nginx.sh | 57 +++++++++++++++++++ .../backend/scripts/validate_be_services.sh | 4 +- 6 files changed, 77 insertions(+), 12 deletions(-) create mode 100644 examples/crash_reporter/backend/nginx.fe-ota.snippet create mode 100755 examples/crash_reporter/backend/scripts/install-fe-ota-nginx.sh diff --git a/docs/INFRA.md b/docs/INFRA.md index 264a9e6..19fb2d4 100644 --- a/docs/INFRA.md +++ b/docs/INFRA.md @@ -182,6 +182,7 @@ Mounted copy: `tmp/FE_gentoo/etc/nginx/nginx.conf`. | `server_name` | `location /` | androidcast crashes | Hub `/app/androidcast_project/` | |---------------|--------------|---------------------|--------------------------------| | **`apps.f0xx.org`** | → `http://artc0:80` | Must **not** → `https://artc0:443/...` (static download) | Hub/crashes blocks must use **`http://artc0:80`** — see `nginx.fe-apps.f0xx.org.snippet` | +| **`/v0/ota/`** on FE | → **`http://artc0:80`** | BE :80 serves static tree | Without this, public OTA is **HTTP 400** while BE localhost is 200 — run `install-fe-ota-nginx.sh` on FE | | **`artc0.f0xx.org`** | → `http://artc0:80` | Legacy → **:8089** | Legacy → **:8089** — **remove** hub block; prefer apps.f0xx.org | **Agent default:** fix **BE `listen 80`** first. Change FE only when user asks or to delete wrong **8089** hub overrides on `artc0.f0xx.org`. diff --git a/docs/OTA.md b/docs/OTA.md index 47178c1..cfb5bc0 100644 --- a/docs/OTA.md +++ b/docs/OTA.md @@ -169,3 +169,4 @@ Legacy `ota.manifest.url` still works as a direct manifest URL fallback. 2. Build signed release APK (`versionCode` is derived automatically). 3. Run `generate-ota-v0.sh` and upload `v0/ota/**` (including `.otabundle.zip`). 4. Confirm `stable.json` points at the new `*_manifest.json`. +5. **Production:** BE `location ^~ /v0/ota/` + artifact mount; **FE** `location /v0/ota/` → `http://artc0:80` (`install-fe-ota-nginx.sh`). Public URL must return **200**, not 400. diff --git a/examples/crash_reporter/backend/nginx.fe-apps.f0xx.org.snippet b/examples/crash_reporter/backend/nginx.fe-apps.f0xx.org.snippet index b952fce..d9fe6cc 100644 --- a/examples/crash_reporter/backend/nginx.fe-apps.f0xx.org.snippet +++ b/examples/crash_reporter/backend/nginx.fe-apps.f0xx.org.snippet @@ -1,15 +1,6 @@ # FE apps.f0xx.org — replace hub/crashes upstream blocks (use BE port 80, preserve URI). -# If location / already proxy_passes to artc0:80, /v0/ota/ needs no extra block once BE serves it. -# Optional explicit block (same upstream as /): -# -# location /v0/ota/ { -# proxy_pass http://artc0.intra.raptor.org:80; -# proxy_http_version 1.1; -# proxy_set_header Host $host; -# proxy_set_header X-Real-IP $remote_addr; -# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; -# proxy_set_header X-Forwarded-Proto $scheme; -# } +# OTA at /v0/ota/ must proxy to BE :80 even when hub uses :443 — see nginx.fe-ota.snippet +# and scripts/install-fe-ota-nginx.sh (public URL 400 until this is applied on FE). # # File: tmp/FE_gentoo/etc/nginx/nginx.conf (inside server { listen 443; server_name apps.f0xx.org; }) # diff --git a/examples/crash_reporter/backend/nginx.fe-ota.snippet b/examples/crash_reporter/backend/nginx.fe-ota.snippet new file mode 100644 index 0000000..12fb070 --- /dev/null +++ b/examples/crash_reporter/backend/nginx.fe-ota.snippet @@ -0,0 +1,13 @@ +# FE apps.f0xx.org — OTA channel at site root (/v0/ota/…). +# BE serves files on listen 80; hub/crashes may use :443 upstream — OTA must hit :80. +# +# Paste inside server { listen 443 ssl; server_name apps.f0xx.org; } before androidcast blocks. + + location /v0/ota/ { + proxy_pass http://artc0.intra.raptor.org:80; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } diff --git a/examples/crash_reporter/backend/scripts/install-fe-ota-nginx.sh b/examples/crash_reporter/backend/scripts/install-fe-ota-nginx.sh new file mode 100755 index 0000000..79df32d --- /dev/null +++ b/examples/crash_reporter/backend/scripts/install-fe-ota-nginx.sh @@ -0,0 +1,57 @@ +#!/usr/bin/env bash +# Run on Gentoo FE as root — proxy /v0/ota/ to BE listen 80 (static OTA tree). +set -euo pipefail + +REPO_ROOT="$(cd "$(dirname "$0")/../../../.." && pwd)" +SNIPPET_FILE="$REPO_ROOT/examples/crash_reporter/backend/nginx.fe-ota.snippet" +NGINX_CONF="${1:-/etc/nginx/nginx.conf}" + +if [[ ! -f "$NGINX_CONF" ]]; then + echo "Usage: $0 [path/to/nginx.conf]" >&2 + exit 1 +fi + +if grep -q 'location /v0/ota/' "$NGINX_CONF"; then + echo "$NGINX_CONF already has location /v0/ota/" + nginx -t + rc-service nginx reload + exit 0 +fi + +python3 - "$NGINX_CONF" "$SNIPPET_FILE" << 'PY' +import sys +from pathlib import Path + +path = Path(sys.argv[1]) +snippet_path = Path(sys.argv[2]) +snippet = snippet_path.read_text() +# Strip comment header lines; keep tab-indented location block only. +lines = [] +for line in snippet.splitlines(): + if line.startswith("#") or not line.strip(): + continue + lines.append(line) +block = "\n".join(lines) + "\n" +text = path.read_text() +needles = [ + "\t\tlocation /app/androidcast_project/ {\n", + "\t\tlocation /app/androidcast_project/crashes/ {\n", +] +idx = -1 +for needle in needles: + idx = text.find(needle) + if idx >= 0: + break +if idx < 0: + raise SystemExit("Could not find androidcast location block in nginx.conf — add nginx.fe-ota.snippet manually") +path.write_text(text[:idx] + block + text[idx:]) +print(f"Patched {path} with /v0/ota/ proxy → BE :80") +PY + +nginx -t +rc-service nginx reload + +echo +echo "=== Verify ===" +curl -sS -o /dev/null -w 'public OTA HTTP %{http_code}\n' \ + 'https://apps.f0xx.org/v0/ota/channel/stable.json' || true diff --git a/examples/crash_reporter/backend/scripts/validate_be_services.sh b/examples/crash_reporter/backend/scripts/validate_be_services.sh index 429ccf3..da1882a 100755 --- a/examples/crash_reporter/backend/scripts/validate_be_services.sh +++ b/examples/crash_reporter/backend/scripts/validate_be_services.sh @@ -64,7 +64,9 @@ code="$(http_code "$OTA")" if [[ "$code" == "200" ]]; then ok "ota $OTA HTTP $code" elif [[ "$code" == "404" ]]; then - note "ota $OTA HTTP 404 — not wired on apps vhost yet" + note "ota $OTA HTTP 404 — BE mount empty or channel missing" +elif [[ "$code" == "400" ]]; then + note "ota $OTA HTTP 400 — FE missing location /v0/ota/ → BE :80 (run install-fe-ota-nginx.sh on FE)" else bad "ota $OTA HTTP $code" fi