T-HUB/infra/occupymedia/edge/watcher.env.example at ea1a9bb4e55796fc70678c4ffa46b49f2bd22254 - hacklab/T-HUB - Forgejo: Beyond coding. We Forge.

hacklab/T-HUB

glass beadian 9365b561b2 Add edge stack: second ingress path + dual-path DNS failover

Cloudflare's tunnel edge-pool assignment can blackhole the site for whole
regions (2026-10-10: tunnel hostnames served from an unreachable anycast
range for hours). This adds an independent path and the automation that
keeps occupymedia.cc reachable when either path is sick:

- nginx edge mirroring the tunnel ingress (app/api/tube/chat/ping), LE
  wildcard via dns-01, twice-daily renewal
- DOCKER-USER firewall: 80/443 restricted to Cloudflare ranges (CF mode)
  or OPEN for grey-cloud mode via firewall.mode
- edge-watcher (60s systemd timer): dynamic public-IP sync, dual-path
  health checks, DNS failover TUNNEL<->ORIGIN/GREY with hysteresis,
  gated by EDGE_ENABLED
- ping.occupymedia.cc sacrificial probe host for activation
- deployment runbook in README.md; credential files shipped as .example

2026-10-10 21:22:15 +00:00

5 lines

214 B

Text

Raw Blame History

 # Cloudflare API token (Zone.DNS edit) — root-only file
 CF_API_TOKEN=<CLOUDFLARE_API_TOKEN>
 # Set to true ONLY after the router port-forward 443->192.168.13.221 is verified.
 EDGE_ENABLED=false
 TARGET_MODE=ORIGIN