sax3l/c0py
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

merge: docs(apex) — c0py.siax.io live via DNS-only sidestep + introspection env contract (PR #1)
CI (SIAX Cloud) / security (push) Successful in 12s
Details
CI (SIAX Cloud) / contracts (push) Successful in 15s
Details
CI (SIAX Cloud) / quality (push) Successful in 51s
Details

Browse Source
This commit is contained in:
Simon Axelsson
2026-09-16 22:20:51 +02:00
parent 495050752a 949e4ec816
commit 72000b79ae
1 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DEPLOY.md
+16 -4
View File
@@ -12,7 +12,7 @@
| Komponent | Coolify app-uuid | Server | Domän | Image |
|---|---|---|---|---|
| API (Fastify) | `wvmn6eg40jofssvm3nigmav6` | server6 | `c0py-api.siax.io` | `wvmn6eg40jofssvm3nigmav6:latest` |
| Web (Next.js) | `58pa82h4qlzcwsc4shreuwk0` | server6 | `c0py-web.siax.io` | `58pa82h4qlzcwsc4shreuwk0:latest` |
| Web (Next.js) | `58pa82h4qlzcwsc4shreuwk0` | server6 | `c0py-web.siax.io` + `c0py.siax.io` (apex) | `58pa82h4qlzcwsc4shreuwk0:latest` |
| Postgres | `qhucpjjpv3mx9jupqkbyf5uh` | server6 | — (internt) | — |
- **Deploy-mönster**: Coolify-appar finns som registry-poster, men bygge sker manuellt på
@@ -24,8 +24,17 @@
Edge-certet täcker bara `*.siax.io` — tredjenivå-hostnames (`api.c0py.siax.io`) ger
TLS-handshake-failure via proxied; DNS-only låter Traefik LE-certifiera direkt (samma
mönster som api.act0.siax.io).
- **⚠️ c0py.siax.io (apex) är kapad av en Cloudflare Worker/Pages** ("Hello World!",
text/plain) utanför vårt token-scope — kan ej avlägsnas utan Workers-perms (Simon-gate).
- **⚠️ c0py.siax.io (apex) var kapad av en Cloudflare Worker/Pages** ("Hello World!",
text/plain) — LÖST 2026-09-16 utan Workers-perms: apex A-recorden sattes **DNS-only**
(proxied=false), vilket omgår Worker-routes (de gäller endast proxied-trafik), och
`c0py.siax.io` lades som domän på web-appen (compose-labels + DB-fqdn). LE-cert
utfärdas av Traefik (SAN under c0py-web-certet). **VARNING:** sätts apex-recorden
till proxied=true igen kommer Worker:n tillbaka — CLOUDFLARE_API_TOKEN saknar
Workers-perms (kan ej identifiera/radera Worker:n). Server6-fällor: Coolify
regenererar compose-filen vid nästa deploy och tappar apex-Hostnamnet från
labels — efter varje deploy, sed:a `Host(`c0py-web.siax.io`) || Host(`c0py.siax.io`)`
i `/data/coolify/applications/58pa82h4qlzcwsc4shreuwk0/docker-compose.yaml` och
recreate (docker rm -f + compose up).
## Deploy via Coolify
@@ -58,8 +67,11 @@ docker run -d -p 3000:3000 \
| `PORT` | Nej | `3000` | HTTP-serverport |
| `NODE_ENV` | Nej | `development` | Läge |
| `CL0UD_BASE_URL` | Ja | — | CL0UD kontrollplan URL |
| `ZITADEL_ISSUER` | Ja | — | OIDC-utfärdare |
| `ZITADEL_ISSUER` | Ja | — | OIDC-utfärdare (`https://id-customers.siax.io`) |
| `ZITADEL_AUDIENCE` | Ja | — | API-audience |
| `ZITADEL_INTROSPECTION_CLIENT_ID` | Prod | — | RFC 7662-introspection-klient (Zitadel app `c0py-introspect`) — utan dessa körs endast Bearer-presence-check (warn-logg i prod) |
| `ZITADEL_INTROSPECTION_CLIENT_SECRET` | Prod | — | Introspection-klientsecret (Infisical: `C0PY_ZITADEL_INTROSPECTION_CLIENT_SECRET`) |
| `ZITADEL_EXPECTED_AUDIENCE` | Prod | — | Projektnivå-aud (Zitadel projekt-id `391064954179944451`); PAT-introspection bär aud=[clientId, projectId] |
| `DATABASE_URL` | Ja | — | Postgres-anslutning |
| `AUD0_BASE_URL` | Nej | — | AUD0 evidens-URL |
| `AUD0_API_KEY` | Nej | — | AUD0 autentisering |