arcanedemesne/gateway-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Gateway Configuration - Cloudflared tunnel, Nginx proxy hub, Podman compose.yml, etc
8 commits 1 branch 0 tags 89 KiB
Find a file
Exact
arcanedemesne 9fcc61ccc6 Add Dockhand edge mapping
2026-07-15 01:48:15 -04:00
.env.example Refactor nginx services and mapping, add dev/prod/stage edges 2026-07-15 00:05:46 -04:00
.gitignore Initial Commit 2026-06-07 11:20:28 -04:00
compose.stage.yml Refactor nginx services and mapping, add dev/prod/stage edges 2026-07-15 00:05:46 -04:00
compose.yml Refactor nginx services and mapping, add dev/prod/stage edges 2026-07-15 00:05:46 -04:00
docker run cloudflare.txt Initial Commit 2026-06-07 11:20:28 -04:00
nginx.conf Add Dockhand edge mapping 2026-07-15 01:48:15 -04:00
PORT_MATRIX.md Add Dockhand edge mapping 2026-07-15 01:48:15 -04:00
README.md Add Dockhand edge mapping 2026-07-15 01:48:15 -04:00

README.md

Gateway

Cloudflare tunnel + hub nginx. Routes public hostnames to edge proxies on gateway-hub.

Port matrix: PORT_MATRIX.md — source of truth for ports, hostnames, OIDC, and architecture.

Hub: gateway-proxy on host network — listens :8080 (prod tunnel) and :8180 (stage tunnel). Forwards to each edge’s published host port (no Podman DNS). That stops whack-a-mole 502s after edge recreate/reload.

Host Edge publish port Compose stack
git.arcanedemesne.com :8081 ../Forgejo
auth.arcanedemesne.com :8082 ../Authentik
arcanedemesne.com / www :8283 (prod) ../ArcaneDemesne/HomeLab
stage.arcanedemesne.com :8183 HomeLab stage
worksuite.arcanedemesne.com :8284 ../ArcaneDemesne/WorkSuite
stage.worksuite.arcanedemesne.com :8184 WorkSuite stage
cup.arcanedemesne.com :8287 ../ArcaneDemesne/HogwartsHouseCup
stage.cup.arcanedemesne.com :8187 Cup stage
mail.arcanedemesne.com :8085 ../Mailpit
dockhand.arcanedemesne.com :8088 ../Dockhand
seedslinger.app / www TBD (hub routes disabled)

Active app work lives under /Repos/ArcaneDemesne/* (e.g. HomeLab). Shared Go libraries: ../ArcaneDemesne/Packages.

Compose

Copy .env.example to .env and set TUNNEL_TOKEN before starting:

cp .env.example .env
podman network create gateway-hub    # once — edge proxies + shared infra only
podman network create authentik-net  # once — Authentik server ↔ app API OIDC backchannel
podman compose up -d

That starts tunnel + one hub (gateway-proxy) on host :8080 and :8180.

Networks: edge stacks still join gateway-hub (optional for hub now). App APIs join authentik-net for OIDC. Each app tier keeps api/app/postgres on its project network.

Cloudflare tunnel: prod → http://127.0.0.1:8080, stage.* → http://127.0.0.1:8180. Tunnel uses TUNNEL_TRANSPORT_PROTOCOL=http2 + IPv4 (see compose) so brief QUIC/UDP drops do not 502 every hostname at once.

Nginx

Hub proxies to 127.0.0.1:<edge-port> (see table above). Missing/down edge → 502 for that Host only; other Hosts keep working. Do not rely on reloading hub after edge recreate — host ports stay stable.

After recreating an app backend (API/app) behind an edge, reload that stack’s edge nginx (edge still uses Podman DNS to api/app):

podman exec homelab-prod-proxy nginx -s reload
podman exec worksuite-prod-proxy nginx -s reload