vh
feef8330ca
Prime approved svos-dev's U13 pre-edit ask (2026-10-10 1639). - B1: release afab123 on nh3-svos (kernel 0.0.9, migration 11->12) after a vzdump and an offline svos.db copy; app-terminal and app-postoffice held on b588510 by drop-ins until the edit. - B2: --app-listen 127.0.0.1:8410 (drop-in) fronted by Caddy as svos-kernel.phasefinal.com on the LAN, allowlisted to nh3-dev; the path list adds /auth/kernel-key, which every connector client needs. DNS rewrite on the three internal AdGuards. - B3/B4: svos-seathost (-> :8404) and svos-highseat (-> :8773) on nh3-dev's fleet Caddy, allowlisted to nh3-svos; /opt/svos apps env on nh3-dev with svos-postoffice[push] (althing-core 3.7.0 from althing 7a2a1c1) and svos-terminal. The fleet Caddyfile is now tracked in configs/.
56 lines
2.1 KiB
Caddyfile
56 lines
2.1 KiB
Caddyfile
{
|
|
email lkraven@lkraven.com
|
|
}
|
|
|
|
# Fleet internal TLS — caddy is the WILDCARD CERT AUTHORITY for *.nh3.phasefinal.com
|
|
# (publicly-trusted LE via Cloudflare DNS-01, renewed automatically). Consumers:
|
|
# * self-terminate with a copy of this cert (talk: ~/talk/certs, kept fresh by
|
|
# fleet-tls-cert-check.timer), OR
|
|
# * front here via a reverse_proxy handle block on @<tool> host <tool>.nh3.phasefinal.com
|
|
*.nh3.phasefinal.com {
|
|
tls {
|
|
dns cloudflare {env.CF_API_TOKEN}
|
|
resolvers 1.1.1.1 8.8.8.8
|
|
}
|
|
# Scriberr (fv-ml1:8080, plain HTTP). Fronted so the browser recorder gets a SecureContext:
|
|
# getUserMedia is refused on http:// origins ("Failed to initialize recorder"). 2026-10-01.
|
|
# Scriberr's ALLOWED_ORIGINS must list this name (fv-ml1 /opt/docker/compose/scriberr/.env).
|
|
@scriberr host scriberr.nh3.phasefinal.com
|
|
handle @scriberr {
|
|
reverse_proxy 10.251.50.54:8080 {
|
|
flush_interval -1
|
|
}
|
|
}
|
|
# SVOS U13 (2026-10-10, Prime-approved; svoperatingsystem docs/operations/u13-svos-edit.md "Before the edit" 2,
|
|
# svos docs/u13-cutover-runbook.md B3/B4). Two app origins on nh3-dev's LOOPBACK, reachable only from nh3-svos
|
|
# (10.100.50.43), whose kernel signs every call it makes to them. Until each app runs (the U13 edit) they answer 502.
|
|
# - svos-seathost: app-terminal, which moves to nh3-dev at the edit (svos-terminal, listener 127.0.0.1:8404).
|
|
# The kernel's instance.toml names this as app-terminal's base_url. No buffering (the app has long-lived routes).
|
|
# - svos-highseat: app-high-seat, the High Seat's signed-only listener (127.0.0.1:8773, enabled at the edit's E1).
|
|
@svos_seathost host svos-seathost.nh3.phasefinal.com
|
|
handle @svos_seathost {
|
|
@not_nh3_svos not remote_ip 10.100.50.43
|
|
handle @not_nh3_svos {
|
|
respond 403
|
|
}
|
|
handle {
|
|
reverse_proxy 127.0.0.1:8404 {
|
|
flush_interval -1
|
|
}
|
|
}
|
|
}
|
|
@svos_highseat host svos-highseat.nh3.phasefinal.com
|
|
handle @svos_highseat {
|
|
@not_nh3_svos not remote_ip 10.100.50.43
|
|
handle @not_nh3_svos {
|
|
respond 403
|
|
}
|
|
handle {
|
|
reverse_proxy 127.0.0.1:8773
|
|
}
|
|
}
|
|
handle {
|
|
respond "nh3 fleet TLS authority — no tool fronted here (talk self-terminates on :8092)" 404
|
|
}
|
|
}
|