disinto-admin/disinto
1
0
Fork 0
Code Issues 21 Pull requests 2 Projects Releases Packages Wiki Activity Actions

Merge pull request 'fix: fix: edge.hcl uses Docker hostname routing — forgejo/woodpecker/chat upstreams unreachable in Nomad (#1031)' (#1032) from fix/issue-1031 into main
All checks were successful
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/nomad-validate Pipeline was successful
Details

Browse source
This commit is contained in:
dev-qwen 2026-04-19 04:50:57 +00:00
commit 7c543c9a16
1 changed files with 22 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nomad/jobs/edge.hcl
View file

@ -6,6 +6,11 @@
# dispatcher sidecar polls disinto-ops for vault actions and dispatches them
# via Nomad batch jobs.
#
# Host networking (issue #1031):
# Caddy uses network_mode = "host" so upstreams are reached at
# 127.0.0.1:<port> (forgejo :3000, woodpecker :8000, chat :8080).
# Staging uses Nomad service discovery (S5-fix-7, issue #1018).
#
# Host_volume contract:
# This job mounts caddy-data from nomad/client.hcl. Path
# /srv/disinto/caddy-data is created by lib/init/nomad/cluster-up.sh before
@ -99,6 +104,7 @@ job "edge" {
# bash, jq, curl, git, docker-cli, python3, openssh-client, autossh).
image = "disinto/edge:local"
force_pull = false
network_mode = "host"
ports = ["http", "https"]
# apparmor=unconfined matches docker-compose — needed for autossh
@ -132,12 +138,12 @@ job "edge" {
# Reverse proxy to Forgejo
handle /forge/* {
reverse_proxy forgejo:3000
reverse_proxy 127.0.0.1:3000
}
# Reverse proxy to Woodpecker CI
handle /ci/* {
reverse_proxy woodpecker:8000
reverse_proxy 127.0.0.1:8000
}
# Reverse proxy to staging — dynamic port via Nomad service discovery
@ -148,19 +154,19 @@ job "edge" {
# Chat service — reverse proxy to disinto-chat backend (#705)
# OAuth routes bypass forward_auth — unauthenticated users need these (#709)
handle /chat/login {
reverse_proxy chat:8080
reverse_proxy 127.0.0.1:8080
}
handle /chat/oauth/callback {
reverse_proxy chat:8080
reverse_proxy 127.0.0.1:8080
}
# Defense-in-depth: forward_auth stamps X-Forwarded-User from session (#709)
handle /chat/* {
forward_auth chat:8080 {
forward_auth 127.0.0.1:8080 {
uri /chat/auth/verify
copy_headers X-Forwarded-User
header_up X-Forward-Auth-Secret {$FORWARD_AUTH_SECRET}
}
reverse_proxy chat:8080
reverse_proxy 127.0.0.1:8080
}
}
EOT
@ -168,7 +174,7 @@ EOT
# ── Non-secret env ───────────────────────────────────────────────────
env {
FORGE_URL = "http://forgejo:3000"
FORGE_URL = "http://127.0.0.1:3000"
FORGE_REPO = "disinto-admin/disinto"
DISINTO_CONTAINER = "1"
PROJECT_NAME = "disinto"
@ -189,6 +195,7 @@ EOT
# Use same disinto/agents:local image as other agents.
image = "disinto/agents:local"
force_pull = false
network_mode = "host"
# apparmor=unconfined matches docker-compose.
security_opt = ["apparmor=unconfined"]
@ -226,7 +233,7 @@ EOT
# ── Non-secret env ───────────────────────────────────────────────────
env {
DISPATCHER_BACKEND = "nomad"
FORGE_URL = "http://forgejo:3000"
FORGE_URL = "http://127.0.0.1:3000"
FORGE_REPO = "disinto-admin/disinto"
FORGE_OPS_REPO = "disinto-admin/disinto-ops"
PRIMARY_BRANCH = "main"