ekklesiaandClaude Opus 5.5
167b4c4f14
CI / verify (pull_request) Successful in 54s
CI / infrastructure-smoke (pull_request) Successful in 21s
CI / migration-smoke (pull_request) Successful in 1m48s
CI / image-build (pull_request) Successful in 27s
CI / deploy-smoke (pull_request) Successful in 42s
Implement ADR 0044's reference deployment as a base Compose file plus overlays, so an installation that already runs a proxy can use the base alone. - compose.yaml: api, postgres, object-storage, and the operator-only migrate (profile ops, plan by default). No published port. api and migrate run init, read-only, tmpfs /tmp, cap_drop ALL, no-new-privileges. postgres is only on the internal data network. - TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3 only, with pg_hba rejecting every non-TLS connection, and the API on verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3 over HTTPS (ADR 0030 requires https in production), trusted by the API through NODE_EXTRA_CA_CERTS. No Core change. - compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME HTTP-01 (DNS-01 documented), routes /, /api/*, /display/*, /assets/* to api and refuses everything else; the storage hostname preserves Host. The API trusts exactly the proxy's fixed /32 on an edge network whose dynamic range excludes the fixed addresses; Caddy overwrites X-Forwarded-For and strips caller-supplied forwarding headers. - compose.tunnel.yaml: cloudflared pinned by digest, token from its own env file; Caddy honors CF-Connecting-IP only from its fixed address. - Four per-service root-owned env files, examples with no values; scripts/init-tls.sh (idempotent, never overwrites a key) and scripts/gen-secrets.sh (prints only). - CI: pnpm deploy:config in ci:verify for all three combinations, and a deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the Dashboard, signed storage delivery, the client-address chain, initial owner sign-in/out, verify-full database TLS, and Doctor through the proxy, against disposable services. tests/deploy.test.ts pins the structural guarantees. - ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS, DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the tunnel's origin TLS settings live in the Cloudflare dashboard, port 80 serves HTTP-01, and secrets are one env file per service. Co-Authored-By: Claude Opus 5.5 <[email protected]>
30 lines
1.4 KiB
Bash
30 lines
1.4 KiB
Bash
# Non-secret settings for the reference deployment's Compose project. Copy to deploy/.env, which
|
|
# Compose reads automatically from this directory. Nothing here is a secret; secrets live in the
|
|
# per-service files under EKKLESIA_ENV_DIR.
|
|
|
|
# The image to run, by registry, name, and tag (or digest). Required.
|
|
EKKLESIA_IMAGE=
|
|
|
|
# Where the root-owned, mode-600 env files and the TLS directory live on the host.
|
|
EKKLESIA_ENV_DIR=/etc/ekklesia
|
|
EKKLESIA_TLS_DIR=/etc/ekklesia/tls
|
|
|
|
# --- compose.proxy.yaml ---------------------------------------------------------------------------
|
|
# The Ekklesia hostname (Dashboard, API, displays) and the storage hostname (signed object URLs).
|
|
EKKLESIA_HOSTNAME=
|
|
EKKLESIA_STORAGE_HOSTNAME=
|
|
# Contact address for the ACME account (certificate expiry notices).
|
|
EKKLESIA_ACME_EMAIL=
|
|
# EKKLESIA_CADDYFILE=./Caddyfile
|
|
# EKKLESIA_PUBLISH_ADDRESS=0.0.0.0
|
|
# EKKLESIA_HTTP_PORT=80
|
|
# EKKLESIA_HTTPS_PORT=443
|
|
|
|
# The edge network. Change the subnet only if it collides with one already on the host. Docker
|
|
# assigns dynamic addresses only from EKKLESIA_EDGE_DYNAMIC_RANGE (the lower half); the proxy and
|
|
# the tunnel connector take fixed addresses from the upper half, so nothing else can ever hold them.
|
|
# EKKLESIA_EDGE_SUBNET=10.249.250.0/24
|
|
# EKKLESIA_EDGE_DYNAMIC_RANGE=10.249.250.0/25
|
|
# EKKLESIA_PROXY_ADDRESS=10.249.250.254
|
|
# EKKLESIA_TUNNEL_ADDRESS=10.249.250.253
|