MinIO was replaced by RustFS; the console label is now objects. and the
public tunnel hostname gig-objectstore.kucial.com.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Cloudflare's free Universal SSL covers kucial.com and *.kucial.com only, so a
hostname published through the tunnel cannot sit under dev.kucial.com's extra
level — it fails TLS at the edge whatever the tunnel says. main is therefore
reached at gig-api.kucial.com publicly and gig-platform.dev.kucial.com on the
LAN (gig-web.kucial.com for gig-app), while the LAN-only instances keep their
deeper names, which Caddy serves with its own DNS-01 certificates.
sites/legacy-gig.caddy is removed: the old preview stack is retired, and its
gig-api.kucial.com block would now collide with main's.
`caddy validate` passes against the custom Cloudflare-DNS build.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01LpmavGWZa9nKFwpeLLW4D3
Project preview instances (gig-platform, gig-app) publish no host ports; they
join an external `edge` Docker network under instance-qualified aliases.
- Caddy joins `edge` and loads per-project sites from sites/*.caddy. It is the
LAN entry: split DNS → Caddy → instance, by hostname label.
- New preview tunnel, `cloudflared-preview`, on `edge` only. It routes public
instance hostnames straight to their aliases, so public previews do not
depend on Caddy, and the connector cannot reach Caddy, the host or LAN
services. The infra tunnel keeps fronting the host's own services via Caddy
and has no route to instances.
- sites/gig-platform.caddy and sites/gig-app.caddy mirror gig-platform's
docs/deploy/caddy/.
- The old host-port gig blocks move to sites/legacy-gig.caddy, to delete at
gig-platform's main cutover.
- Global client-IP trust for requests arriving through cloudflared.
Validated with the custom Cloudflare-DNS build (`caddy validate`).
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MTExEkPpPMV4gSdfHpztra
kongkx
