From faccacd2c997136ba004175dcae83be57ed76d00 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Mon, 9 Nov 2026 18:29:05 +0000 Subject: [PATCH] dev2: track the gateway.c0mpute.com vhost; /git/ goes to vienna The dev2 disk is full, so the dev2 node has an automatic hosting budget of 0 and every git push through gateway.c0mpute.com got 507. /git/ now proxies to vienna :7777 (2900 GiB). Applied live and verified: push + clone through https://gateway.c0mpute.com. Co-Authored-By: Claude Opus 5.5 --- dev2/c0mpute-gateway/README.md | 12 +++++ dev2/c0mpute-gateway/install.sh | 3 ++ .../nginx-gateway.c0mpute.com.conf | 52 +++++++++++++++++++ 3 files changed, 67 insertions(+) create mode 100644 dev2/c0mpute-gateway/nginx-gateway.c0mpute.com.conf diff --git a/dev2/c0mpute-gateway/README.md b/dev2/c0mpute-gateway/README.md index 5ac7d94..660bdb9 100644 --- a/dev2/c0mpute-gateway/README.md +++ b/dev2/c0mpute-gateway/README.md @@ -19,4 +19,16 @@ config edit: `ssh root@dev2.profullstack.com systemctl restart c0mpute-worker`. purpose for longer than a minute, stop the timer too: `systemctl stop c0mpute-gateway-watchdog.timer c0mpute-worker`. +## nginx: `gateway.c0mpute.com` + +`nginx-gateway.c0mpute.com.conf` is the vhost (TLS on `127.0.0.1:8444` behind the +proxy-protocol listener). Everything goes to the local worker on `:7777` **except +`/git/`**, which goes to vienna (`http://dev.chovy.com:7777`, node AmaKBdpB, 2900 GiB +hosting budget). dev2's disk is full, so its own node's automatic hosting budget is 0 +and it refused every `git push` with 507; a gateway has to hold a pushed repo before the +network copies it. Pushes are owner-signed and every file is hash-checked by the client, +so the plain-HTTP hop to vienna does not weaken them. `/git/` allows 1100 MB bodies (the +repo size limit plus headroom). If vienna goes away, point that block at another node +with room (seed1's :7777 is firewalled from outside). + Install / update: `scp -r dev2/c0mpute-gateway root@dev2.profullstack.com:/root/ && ssh root@dev2.profullstack.com /root/c0mpute-gateway/install.sh` diff --git a/dev2/c0mpute-gateway/install.sh b/dev2/c0mpute-gateway/install.sh index fcdbe9a..1abd30b 100755 --- a/dev2/c0mpute-gateway/install.sh +++ b/dev2/c0mpute-gateway/install.sh @@ -9,6 +9,9 @@ install -m 0644 c0mpute-gateway-watchdog.service c0mpute-gateway-watchdog.timer install -d /etc/systemd/system/c0mpute-worker.service.d /etc/systemd/system/moshpit-c0mpute-edge.service.d install -m 0644 c0mpute-worker.service.d-resilient.conf /etc/systemd/system/c0mpute-worker.service.d/resilient.conf install -m 0644 moshpit-c0mpute-edge.service.d-perms.conf /etc/systemd/system/moshpit-c0mpute-edge.service.d/perms.conf +install -m 0644 nginx-gateway.c0mpute.com.conf /etc/nginx/sites-available/gateway.c0mpute.com +ln -sf /etc/nginx/sites-available/gateway.c0mpute.com /etc/nginx/sites-enabled/gateway.c0mpute.com +nginx -t && systemctl reload nginx systemctl daemon-reload systemctl enable --now c0mpute-gateway-watchdog.timer systemctl show c0mpute-worker -p Restart -p StartLimitIntervalUSec diff --git a/dev2/c0mpute-gateway/nginx-gateway.c0mpute.com.conf b/dev2/c0mpute-gateway/nginx-gateway.c0mpute.com.conf new file mode 100644 index 0000000..138d9ee --- /dev/null +++ b/dev2/c0mpute-gateway/nginx-gateway.c0mpute.com.conf @@ -0,0 +1,52 @@ +# c0mpute gateway for dev2 worker (:7777): hosting sites (/s//), storage, opendisk. +# Announced as gateway.announce so the Moshpit edge and d1sks can reach it. 2026-11-09 riotcoder +server { + listen 80; + listen [::]:80; + server_name gateway.c0mpute.com; + location ^~ /.well-known/acme-challenge/ { + root /var/www/acme; + default_type "text/plain"; + } + location / { + return 301 https://$host$request_uri; + } +} +server { + listen 127.0.0.1:8444 ssl proxy_protocol; + http2 on; + server_name gateway.c0mpute.com; + ssl_certificate /etc/nginx/ssl/gateway.c0mpute.com/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/gateway.c0mpute.com/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers off; + client_max_body_size 64m; + # Git hosting goes to vienna (node AmaKBdpB, 2900 GiB budget): the dev2 disk + # is full, so the dev2 node refuses pushes (507). Pushes are owner-signed and + # hash-checked end to end, so the plain-HTTP hop does not weaken them. + # 2026-11-09 riotcoder + location ^~ /git/ { + client_max_body_size 1100m; + proxy_pass http://dev.chovy.com:7777; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_connect_timeout 10s; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + proxy_buffering off; + proxy_request_buffering off; + } + location / { + proxy_pass http://127.0.0.1:7777; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_read_timeout 300s; + proxy_buffering off; + } +}