zeekay
f753ce5254
A universe is values files, so what breaks is a file the chart can no longer template -- and today that is invisible until CD syncs and the service is already down. Rendering every file against the chart CD will use, at the version CD will use, moves that failure onto the push that caused it. CI does not deploy: applying is CD's one job, and a second path means the cluster can disagree with git while both report success. Two files moved out of deploy/ because they are not values at all -- the generator globs deploy/*/*.yaml, so a tunnel config sitting there becomes an Application that cannot render.
85 lines
3.9 KiB
YAML
85 lines
3.9 KiB
YAML
# ingress.yaml — public hostname -> local origin for the Spark reboot.
|
|
#
|
|
# DO is gone. The Lux and Zoo chain surfaces are served from luxd processes on
|
|
# the Spark box and reached through a Cloudflare tunnel, so there is no public
|
|
# IP and nothing open on the firewall.
|
|
#
|
|
# These rows are the tunnel's ingress list. cloudflared MATCHES on `path` and
|
|
# passes it through unchanged — it cannot rewrite — so each origin serves the
|
|
# final public path itself. That is why the chain rows carry no rewrite: luxd
|
|
# already mounts chain RPC at /v1/chain/<alias>/rpc (server/http/server.go
|
|
# baseURL="/v1", chains/manager.go ChainAliasPrefix="chain"). The /ext prefix
|
|
# is gone upstream; nothing here reintroduces it.
|
|
#
|
|
# Chain state came from canonical RLP in luxfi/state, verified by comparing the
|
|
# booted block 0 hash against the hash in the RLP itself — see LLM.md.
|
|
#
|
|
# HOSTNAMES ARE SINGLE-LABEL, and that is not a style choice. Cloudflare's
|
|
# universal certificate for this zone covers exactly:
|
|
#
|
|
# DNS:lux.network, DNS:*.lux.network
|
|
#
|
|
# One label. A two-label name like testnet.api.lux.network matches no SAN, so
|
|
# TLS fails at the edge in ~40ms and the request never reaches a tunnel rule —
|
|
# it looks like a routing or origin fault and is neither. Hence api-testnet,
|
|
# not testnet.api. The zone already reads this way (api-exchange, api-bridge,
|
|
# api-explore-hanzo-test), so this is the existing convention, not a new one.
|
|
# zoo.network carries the same single-label wildcard and the same rule.
|
|
#
|
|
# The node must also bind 0.0.0.0: cloudflared reaches an origin over the host
|
|
# network, and --http-allowed-hosts stays the real access control. UFW keeps
|
|
# the wider bind off the public internet, though it does allow 10.0.0.0/8, and
|
|
# the allow-list accepts any request whose Host is a bare IP — so a bound port
|
|
# is LAN-readable by design. That is fine for read RPC and was NOT fine while
|
|
# admin_importChain was still mounted; see LLM.md.
|
|
|
|
tunnel: lux-dchain
|
|
id: 682f3c05-bce2-4bfd-a657-41fe4644c54c
|
|
cname: 682f3c05-bce2-4bfd-a657-41fe4644c54c.cfargotunnel.com
|
|
|
|
ingress:
|
|
# ── Lux chain RPC ────────────────────────────────────────────────
|
|
- hostname: api.lux.network
|
|
path: ^/v1/chain
|
|
service: http://127.0.0.1:9630
|
|
note: luxd network 96369, C-chain chainId 96369
|
|
|
|
- hostname: api-testnet.lux.network
|
|
path: ^/v1/chain
|
|
service: http://127.0.0.1:9640
|
|
note: luxd network 96368, C-chain chainId 96368 — LIVE
|
|
|
|
# ── Explorer — ONE binary, branded per hostname ──────────────────
|
|
- hostname: explorer.lux.network
|
|
service: http://127.0.0.1:8090
|
|
|
|
# ── D-Chain venue (already live, unchanged) ──────────────────────
|
|
- hostname: dchain.lux.network
|
|
service: http://127.0.0.1:9610
|
|
|
|
- service: http_status:404
|
|
|
|
# ── Zoo ───────────────────────────────────────────────────────────
|
|
# Zoo is a separate org with its own registry and its own brand. It gets its
|
|
# own tunnel rather than riding the Lux one; the rows below are that tunnel's
|
|
# ingress, pending its creation by the operator who holds the Cloudflare key.
|
|
zoo:
|
|
tunnel: zoo-local
|
|
id: null # operator creates; fill in the uuid and its cfargotunnel.com cname
|
|
ingress:
|
|
- hostname: api.zoo.network
|
|
path: ^/v1/chain
|
|
service: http://127.0.0.1:9650
|
|
note: luxd network 200200, EVM chainId 200200
|
|
|
|
- hostname: api-testnet.zoo.network
|
|
path: ^/v1/chain
|
|
service: http://127.0.0.1:9660
|
|
note: luxd network 200201, EVM chainId 200201
|
|
|
|
- hostname: explorer.zoo.network
|
|
service: http://127.0.0.1:8090
|
|
note: same explorer binary; brand is chosen per chain in chains.yaml
|
|
|
|
- service: http_status:404
|