gitadmin/fxhnt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(infra): cockpit.fxhnt.ai TLS/access — serve both names + add cockpit DNS A record

Browse Source 
The dashboard->cockpit rename broke access: cockpit.fxhnt.ai had no DNS record (per-host, no
wildcard) and dashboard.fxhnt.ai was 301'd to the dead name. Fix: proxy serves both names (no
redirect), cockpit A record added (live via API + codified in dns module). *.fxhnt.ai LE cert
already covers cockpit. Verified: cockpit.fxhnt.ai resolves + 200 + valid cert; dashboard still 200.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
jgrusewski
2026-06-24 17:35:35 +02:00
parent 07e0daa669
commit 8aa74c6d7c
2 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
infra/k8s/gitlab/tailscale-proxy.yaml
View File

@@ -226,9 +226,11 @@ data:
# the pod CIDR 100.64.0.0/15 overlaps Tailscale CGNAT, so this kernel-mode proxy can't reach platform-pool
# pods via ClusterIP, but it CAN reach another tailnet node. IP is stable while the cockpit's TS state
# secret (fxhnt-dashboard-ts-state) persists. (Was web-dashboard.foxhunt.svc — replaced by the fxhnt cockpit.)
# Both names serve the cockpit (no redirect — cockpit.fxhnt.ai needs its own DNS A record, added in the
# dns module; dashboard.fxhnt.ai keeps working so renaming never breaks access). *.fxhnt.ai wildcard cert covers both.
server {
listen 443 ssl;
server_name cockpit.fxhnt.ai;
server_name cockpit.fxhnt.ai dashboard.fxhnt.ai;
ssl_certificate /etc/nginx/certs/tls.crt;
ssl_certificate_key /etc/nginx/certs/tls.key;
@@ -246,18 +248,6 @@ data:
}
}
# Back-compat: old dashboard.fxhnt.ai -> 301 redirect to cockpit.fxhnt.ai (keeps existing bookmarks working).
server {
listen 443 ssl;
server_name dashboard.fxhnt.ai;
ssl_certificate /etc/nginx/certs/tls.crt;
ssl_certificate_key /etc/nginx/certs/tls.key;
ssl_protocols TLSv1.2 TLSv1.3;
return 301 https://cockpit.fxhnt.ai$request_uri;
}
# API Gateway (gRPC-Web + gRPC) — api.fxhnt.ai
# Browser dashboard uses gRPC-web (HTTP/1.1 POST), so proxy_pass not grpc_pass
server {

12
infra/modules/dns/main.tf
View File

@@ -24,6 +24,18 @@ resource "scaleway_domain_record" "dashboard" {
ttl = 300
}
# fxhnt cockpit primary hostname (renamed from dashboard 2026-06-24). Added live via the Scaleway DNS API first
# to unbreak access; codified here for IaC. NOTE: next `terragrunt apply` must IMPORT this record (it exists in
# the zone but not in TF state) — `terragrunt import scaleway_domain_record.cockpit <zone>/<record_id>` — else
# apply will try to re-create it.
resource "scaleway_domain_record" "cockpit" {
dns_zone = var.dns_zone
name = "cockpit"
type = "A"
data = var.git_ip
ttl = 300
}
resource "scaleway_domain_record" "api" {
dns_zone = var.dns_zone
name = "api"