raucao
44f86d3f07
Move kredits-github onto Node 22.23.4 and behind the openresty reverse proxy on the proxy hosts, replacing its own nginx + the custom haproxy entry. - pin Node 22.23.4; run the app with HOST=0.0.0.0 / NODE_ENV=production and open port 3000 to 10.1.1.0/24 so the proxy can reach it over ZeroTier - create /opt/kredits-github owned by the deploy user before cloning - add kredits-github::nginx_proxy (tls_cert_for + openresty_site, upstream from role:kredits_github) and register it in the openresty_proxy run list - drop the app-node nginx recipe/template and its role entry
31 lines
889 B
Ruby
31 lines
889 B
Ruby
#
|
|
# Cookbook Name:: kredits-github
|
|
# Recipe:: nginx_proxy
|
|
#
|
|
# Terminates TLS and proxies kredits-github.kosmos.org to the app node
|
|
# (role:kredits_github) over the ZeroTier network. Runs on the proxy hosts.
|
|
#
|
|
|
|
domain = node['kredits-github']['domain']
|
|
|
|
kredits_node = search(:node, 'role:kredits_github').first
|
|
|
|
if kredits_node.nil?
|
|
Chef::Log.warn("No node found with 'kredits_github' role. Not configuring openresty site.")
|
|
return
|
|
end
|
|
|
|
tls_cert_for domain do
|
|
auth 'gandi_dns'
|
|
action :create
|
|
end
|
|
|
|
openresty_site domain do
|
|
template 'nginx_conf_kredits_github_proxy.erb'
|
|
variables domain: domain,
|
|
upstream_host: kredits_node['knife_zero']['host'],
|
|
upstream_port: node['kredits-github']['port'],
|
|
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
|
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
|
|
end
|