olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bootstrap): caddy public ingress + DNS-01 TLS (T07)

Browse source 
foundation-caddy — the only public ingress (80/443 published), automatic TLS via
Let's Encrypt DNS-01 over Cloudflare. Standard caddy:2 lacks the DNS plugin, so
the egg builds a custom image on the VM (containers/caddy-cloudflare/Dockerfile:
xcaddy + caddy-dns/cloudflare@v0.2.4, base digests pinned) via a remote.Command
(ADR-007) whose stdout image id the container runs. The Caddyfile carries no
secrets — the CF token is read from the container env ({env.CF_API_TOKEN}) — and
is rendered + bind-mounted from the host. Routes forge -> Forgejo:3000 and
s3 -> RustFS:9000; Vault is intentionally not proxied publicly (CONTRACT_003
"restricted").

Live on cx33 Helsinki: certs obtained for forge + s3; https://forge.olsitec.net
= 502 (Forgejo lands in T08) and https://s3.olsitec.net = 403 (RustFS), both over
valid Let's Encrypt certs (DNS-01). Acceptance T07 met.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andreas Niemann 2026-06-30 21:54:12 +02:00
parent fa242e4e76
commit 6a7c28b54c
4 changed files with 168 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
bootstrap/index.ts
View file

@ -16,6 +16,7 @@ import {
import { deployPostgres } from "./components/postgres";
import { deployRustfs } from "./components/rustfs";
import { deployVault } from "./components/vault";
import { deployProxy } from "./components/proxy";
const cfg = loadConfig();
@ -44,9 +45,9 @@ const vault = deployVault(ctx);
const vaultCreds = writeCredentialsToVault(ctx, credentials, vault);
// =============================================================================
// PHASE 6 — FORGE (depends on: credentials, GATE A)
// T07 caddy · T08 forgejo · T10 runner
// T07 caddy ✓ · T08 forgejo · T10 runner
// -----------------------------------------------------------------------------
// const proxy = deployProxy(ctx);
const proxy = deployProxy(ctx);
// const forgejo = deployForgejo(ctx, { postgres, rustfs, credentials, proxy });
// --- GATE B: Forgejo healthy → handover (T11) + runner registration (T10).
// const runner = deployRunner(ctx, { forgejo, credentials });
@ -56,7 +57,8 @@ const vaultCreds = writeCredentialsToVault(ctx, credentials, vault);
// vaultCreds (T06) is a gate for Forgejo (T08) — it has no output to export yet.
void vaultCreds;
export const phase = "T06-credentials"; // data-plane + creds-in-Vault
export const phase = "T07-caddy"; // data-plane + creds + public ingress (Caddy)
export const caddyImageId = proxy.imageId;
export const networkName = network.name;
export const vmTarget = `${cfg.vm.user}@${cfg.vm.host}`;
export const postgresEndpoint = postgres.endpoint;