kongkxandClaude Opus 5
6379e8c147
Project preview instances (gig-platform, gig-app) publish no host ports; they join an external `edge` Docker network under instance-qualified aliases. - Caddy joins `edge` and loads per-project sites from sites/*.caddy. It is the LAN entry: split DNS → Caddy → instance, by hostname label. - New preview tunnel, `cloudflared-preview`, on `edge` only. It routes public instance hostnames straight to their aliases, so public previews do not depend on Caddy, and the connector cannot reach Caddy, the host or LAN services. The infra tunnel keeps fronting the host's own services via Caddy and has no route to instances. - sites/gig-platform.caddy and sites/gig-app.caddy mirror gig-platform's docs/deploy/caddy/. - The old host-port gig blocks move to sites/legacy-gig.caddy, to delete at gig-platform's main cutover. - Global client-IP trust for requests arriving through cloudflared. Validated with the custom Cloudflare-DNS build (`caddy validate`). Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MTExEkPpPMV4gSdfHpztra
43 lines
1.5 KiB
Plaintext
43 lines
1.5 KiB
Plaintext
# gig-platform instances. Copy to the infra Caddy's sites/ directory.
|
|
#
|
|
# Every instance's nginx joins the external `edge` network as
|
|
# gig-platform-<instance>-nginx; so do main's permission gates. See
|
|
# docs/deploy/instances.md.
|
|
|
|
# main, at the apex. Its own site, not a case of the wildcard below: Caddy
|
|
# indexes host labels from the right, so {http.request.host.labels.4} is
|
|
# `pr-57` for pr-57.gig-platform.dev.kucial.com but empty for the apex, which
|
|
# would proxy to `gig-platform--nginx`.
|
|
gig-platform.dev.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy gig-platform-main-nginx:80
|
|
}
|
|
|
|
*.gig-platform.dev.kucial.com {
|
|
import cloudflare_tls
|
|
|
|
# main's internal surfaces. These labels are reserved: instance names are
|
|
# restricted to main, e2e and pr-<N>, so none can collide with them.
|
|
@studio host studio.gig-platform.dev.kucial.com
|
|
@minio host minio.gig-platform.dev.kucial.com
|
|
@horizon host horizon.gig-platform.dev.kucial.com
|
|
handle @studio {
|
|
reverse_proxy gig-platform-main-db-studio-gate:80
|
|
}
|
|
handle @minio {
|
|
reverse_proxy gig-platform-main-minio-console-gate:80
|
|
}
|
|
handle @horizon {
|
|
reverse_proxy gig-platform-main-horizon-gate:80
|
|
}
|
|
|
|
handle {
|
|
# Per-request placeholder upstream: e2e and pr-<N> instances. A name
|
|
# that resolves to nothing — a closed PR — returns 502.
|
|
#
|
|
# Placeholder upstreams share one upstream's health and load-balancing
|
|
# state across every instance, so never add health checks here.
|
|
reverse_proxy gig-platform-{http.request.host.labels.4}-nginx:80
|
|
}
|
|
}
|