sync

docs/INFRA.md

@@ -182,6 +182,7 @@ Mounted copy: `tmp/FE_gentoo/etc/nginx/nginx.conf`.
 | `server_name` | `location /` | androidcast crashes | Hub `/app/androidcast_project/` |
 |---------------|--------------|---------------------|--------------------------------|
 | **`apps.f0xx.org`** | → `http://artc0:80` | Must **not** → `https://artc0:443/...` (static download) | Hub/crashes blocks must use **`http://artc0:80`** — see `nginx.fe-apps.f0xx.org.snippet` |
+| **`/v0/ota/`** on FE | → **`http://artc0:80`** | BE :80 serves static tree | Without this, public OTA is **HTTP 400** while BE localhost is 200 — run `install-fe-ota-nginx.sh` on FE |
 | **`artc0.f0xx.org`** | → `http://artc0:80` | Legacy → **:8089** | Legacy → **:8089** — **remove** hub block; prefer apps.f0xx.org |
 
 **Agent default:** fix **BE `listen 80`** first. Change FE only when user asks or to delete wrong **8089** hub overrides on `artc0.f0xx.org`.

docs/OTA.md

@@ -169,3 +169,4 @@ Legacy `ota.manifest.url` still works as a direct manifest URL fallback.
 2. Build signed release APK (`versionCode` is derived automatically).
 3. Run `generate-ota-v0.sh` and upload `v0/ota/**` (including `.otabundle.zip`).
 4. Confirm `stable.json` points at the new `*_manifest.json`.
+5. **Production:** BE `location ^~ /v0/ota/` + artifact mount; **FE** `location /v0/ota/` → `http://artc0:80` (`install-fe-ota-nginx.sh`). Public URL must return **200**, not 400.

examples/crash_reporter/backend/nginx.fe-apps.f0xx.org.snippet

@@ -1,15 +1,6 @@
 # FE apps.f0xx.org — replace hub/crashes upstream blocks (use BE port 80, preserve URI).
-# If location / already proxy_passes to artc0:80, /v0/ota/ needs no extra block once BE serves it.
+# OTA at /v0/ota/ must proxy to BE :80 even when hub uses :443 — see nginx.fe-ota.snippet
-# Optional explicit block (same upstream as /):
+# and scripts/install-fe-ota-nginx.sh (public URL 400 until this is applied on FE).
-#
-#		location /v0/ota/ {
-#		 	proxy_pass http://artc0.intra.raptor.org:80;
-#		 	proxy_http_version 1.1;
-#		 	proxy_set_header Host              $host;
-#		 	proxy_set_header X-Real-IP         $remote_addr;
-#		 	proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-#		 	proxy_set_header X-Forwarded-Proto $scheme;
-#		}
 #
 # File: tmp/FE_gentoo/etc/nginx/nginx.conf  (inside server { listen 443; server_name apps.f0xx.org; })
 #

examples/crash_reporter/backend/nginx.fe-ota.snippet

@@ -0,0 +1,13 @@
+# FE apps.f0xx.org — OTA channel at site root (/v0/ota/…).
+# BE serves files on listen 80; hub/crashes may use :443 upstream — OTA must hit :80.
+#
+# Paste inside server { listen 443 ssl; server_name apps.f0xx.org; } before androidcast blocks.
+
+		location /v0/ota/ {
+		 	proxy_pass http://artc0.intra.raptor.org:80;
+		 	proxy_http_version 1.1;
+		 	proxy_set_header Host              $host;
+		 	proxy_set_header X-Real-IP         $remote_addr;
+		 	proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+		 	proxy_set_header X-Forwarded-Proto $scheme;
+		}

examples/crash_reporter/backend/scripts/install-fe-ota-nginx.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Run on Gentoo FE as root — proxy /v0/ota/ to BE listen 80 (static OTA tree).
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../../../.." && pwd)"
+SNIPPET_FILE="$REPO_ROOT/examples/crash_reporter/backend/nginx.fe-ota.snippet"
+NGINX_CONF="${1:-/etc/nginx/nginx.conf}"
+
+if [[ ! -f "$NGINX_CONF" ]]; then
+  echo "Usage: $0 [path/to/nginx.conf]" >&2
+  exit 1
+fi
+
+if grep -q 'location /v0/ota/' "$NGINX_CONF"; then
+  echo "$NGINX_CONF already has location /v0/ota/"
+  nginx -t
+  rc-service nginx reload
+  exit 0
+fi
+
+python3 - "$NGINX_CONF" "$SNIPPET_FILE" << 'PY'
+import sys
+from pathlib import Path
+
+path = Path(sys.argv[1])
+snippet_path = Path(sys.argv[2])
+snippet = snippet_path.read_text()
+# Strip comment header lines; keep tab-indented location block only.
+lines = []
+for line in snippet.splitlines():
+    if line.startswith("#") or not line.strip():
+        continue
+    lines.append(line)
+block = "\n".join(lines) + "\n"
+text = path.read_text()
+needles = [
+    "\t\tlocation /app/androidcast_project/ {\n",
+    "\t\tlocation /app/androidcast_project/crashes/ {\n",
+]
+idx = -1
+for needle in needles:
+    idx = text.find(needle)
+    if idx >= 0:
+        break
+if idx < 0:
+    raise SystemExit("Could not find androidcast location block in nginx.conf — add nginx.fe-ota.snippet manually")
+path.write_text(text[:idx] + block + text[idx:])
+print(f"Patched {path} with /v0/ota/ proxy → BE :80")
+PY
+
+nginx -t
+rc-service nginx reload
+
+echo
+echo "=== Verify ==="
+curl -sS -o /dev/null -w 'public OTA HTTP %{http_code}\n' \
+  'https://apps.f0xx.org/v0/ota/channel/stable.json' || true

examples/crash_reporter/backend/scripts/validate_be_services.sh

@@ -64,7 +64,9 @@ code="$(http_code "$OTA")"
 if [[ "$code" == "200" ]]; then
   ok "ota $OTA HTTP $code"
 elif [[ "$code" == "404" ]]; then
-  note "ota $OTA HTTP 404 — not wired on apps vhost yet"
+  note "ota $OTA HTTP 404 — BE mount empty or channel missing"
+elif [[ "$code" == "400" ]]; then
+  note "ota $OTA HTTP 400 — FE missing location /v0/ota/ → BE :80 (run install-fe-ota-nginx.sh on FE)"
 else
   bad "ota $OTA HTTP $code"
 fi