Robert Syrnicki
6b8cc6e006
- Always build from the checkout (`up --build`, `pull_policy: build`) instead of reusing a stale local image or pulling an old registry one. - --render-only writes to rendered/ and no longer touches the live Traefik dynamic directory; the route is installed after health check. - Join the Traefik network via a generated docker-compose.override.yaml rather than `docker network connect` after startup, which raced the control-plane's startup call to wg-easy and was lost on recreate. - Add --non-interactive, check the public HTTPS endpoint, and point the closing instructions at Settings -> Gateway (the suggested `furtka gateway connect` command doesn't exist). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
2.6 KiB
Text
51 lines
2.6 KiB
Text
# Template for the control-plane's own Traefik route. ops/deploy.sh renders
|
|
# it to rendered/control-plane.yml and installs it into the directory YOUR
|
|
# Traefik's file provider watches, with two placeholders substituted:
|
|
#
|
|
# GATEWAY_CONTROL_PLANE_HOST a real hostname you control (e.g.
|
|
# gw.example.com), with its own A/AAAA record
|
|
# pointing at this host.
|
|
# GATEWAY_CONTROL_PLANE_TARGET where YOUR Traefik actually reaches the
|
|
# control-plane container. If it joined your
|
|
# Traefik's docker network (the recommended
|
|
# path — ops/deploy.sh sets that up), this is
|
|
# `furtka-gateway-control-plane:8090`, the
|
|
# container's fixed name (unambiguous on a
|
|
# shared network, unlike a generic service
|
|
# name like `control-plane`).
|
|
# If instead you exposed it on a separate
|
|
# host (GATEWAY_CONTROL_PLANE_BIND widened
|
|
# beyond 127.0.0.1 in docker-compose.yaml),
|
|
# this is that host's real reachable
|
|
# `host:port` — see ops/deploy.sh's warning
|
|
# about the access-control implication of
|
|
# that path.
|
|
#
|
|
# Without this file, the control-plane API is only reachable at
|
|
# 127.0.0.1:8090 on this host itself — fine for a local health check,
|
|
# useless for a real remote Furtka box, which needs this over HTTPS
|
|
# anyway: the registration response carries a WireGuard private key in
|
|
# plaintext JSON, so that call must never go out over bare HTTP.
|
|
#
|
|
# GATEWAY_MODE=single: keep the certResolver line below, set to whatever
|
|
# resolver name YOUR Traefik already has configured (blank/omit the `tls:`
|
|
# block entirely if your Traefik applies a default cert automatically —
|
|
# see GATEWAY_CERT_RESOLVER in .env.example, which controls this same
|
|
# choice for every *app* route furtka-gateway publishes; keep both
|
|
# consistent).
|
|
# GATEWAY_MODE=shared: delete the `tls:` block entirely — the shared
|
|
# wildcard defaultGeneratedCert (traefik/dynamic/default-cert.yml) already
|
|
# covers every hostname under GATEWAY_BASE_DOMAIN, this included.
|
|
http:
|
|
routers:
|
|
control-plane:
|
|
rule: "Host(`GATEWAY_CONTROL_PLANE_HOST`)"
|
|
entryPoints: [websecure]
|
|
service: control-plane
|
|
tls:
|
|
certResolver: le
|
|
services:
|
|
control-plane:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://GATEWAY_CONTROL_PLANE_TARGET"
|