glass beadian
9365b561b2
Cloudflare's tunnel edge-pool assignment can blackhole the site for whole regions (2026-10-10: tunnel hostnames served from an unreachable anycast range for hours). This adds an independent path and the automation that keeps occupymedia.cc reachable when either path is sick: - nginx edge mirroring the tunnel ingress (app/api/tube/chat/ping), LE wildcard via dns-01, twice-daily renewal - DOCKER-USER firewall: 80/443 restricted to Cloudflare ranges (CF mode) or OPEN for grey-cloud mode via firewall.mode - edge-watcher (60s systemd timer): dynamic public-IP sync, dual-path health checks, DNS failover TUNNEL<->ORIGIN/GREY with hysteresis, gated by EDGE_ENABLED - ping.occupymedia.cc sacrificial probe host for activation - deployment runbook in README.md; credential files shipped as .example
7 lines
426 B
Desktop File
7 lines
426 B
Desktop File
[Unit]
|
|
Description=Renew occupymedia edge Let's Encrypt cert (dns-01)
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=docker run --rm -v /opt/anarchoposter/infra/occupymedia/edge/certs:/etc/letsencrypt -v /opt/anarchoposter/infra/occupymedia/edge/cloudflare.ini:/etc/cloudflare.ini:ro certbot/dns-cloudflare:latest renew --dns-cloudflare --dns-cloudflare-credentials=/etc/cloudflare.ini
|
|
ExecStartPost=docker exec occ-edge-1 nginx -s reload
|