hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Add edge stack: second ingress path + dual-path DNS failover

Browse source 
Cloudflare's tunnel edge-pool assignment can blackhole the site for whole
regions (2026-10-10: tunnel hostnames served from an unreachable anycast
range for hours). This adds an independent path and the automation that
keeps occupymedia.cc reachable when either path is sick:

- nginx edge mirroring the tunnel ingress (app/api/tube/chat/ping), LE
  wildcard via dns-01, twice-daily renewal
- DOCKER-USER firewall: 80/443 restricted to Cloudflare ranges (CF mode)
  or OPEN for grey-cloud mode via firewall.mode
- edge-watcher (60s systemd timer): dynamic public-IP sync, dual-path
  health checks, DNS failover TUNNEL<->ORIGIN/GREY with hysteresis,
  gated by EDGE_ENABLED
- ping.occupymedia.cc sacrificial probe host for activation
- deployment runbook in README.md; credential files shipped as .example
This commit is contained in:
glass beadian 2026-10-10 21:22:15 +00:00
parent aa5e262f3a
commit 9365b561b2
12 changed files with 438 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

134
infra/occupymedia/edge/nginx.conf Normal file
View file

@ -0,0 +1,134 @@
# occupymedia.cc edge — Cloudflare origin-pull terminator.
# Mirrors the tunnel ingress: host-routed reverse proxy in front of the apps.
# TLS: Let's Encrypt wildcard (dns-01). HTTP: redirect only.
worker_processes auto;
events { worker_connections 1024; }
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
sendfile on;
server_tokens off;
map $http_upgrade $connection_upgrade {
default upgrade;
"" close;
}
# HTTP: redirect everything to HTTPS.
server {
listen 80;
listen [::]:80;
return 301 https://$host$request_uri;
}
# Public apps. Origins mirror the cloudflared ingress:
# app -> occ-app web:3001 api -> occ-app api:3000
# tube -> occ-tube 9000 chat -> occ-chat 6167
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_name app.occupymedia.cc;
ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
client_max_body_size 512m;
location / {
proxy_pass http://web:3001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_name api.occupymedia.cc;
ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
client_max_body_size 512m;
location / {
proxy_pass http://api:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name tube.occupymedia.cc;
ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
client_max_body_size 0;
location / {
proxy_pass http://100.92.231.98:9000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
proxy_buffering off;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name chat.occupymedia.cc;
ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
location / {
proxy_pass http://100.117.210.52:6167;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name ping.occupymedia.cc;
ssl_certificate /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
return 200 "edge-ok";
}
# Everything else on this IP: drop the connection.
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
ssl_reject_handshake on;
}
}