forked from linux/WebHosting
29 lines
1.8 KiB
Markdown
29 lines
1.8 KiB
Markdown
# WebHosting
|
|
|
|
Shared web applications behind Nginx/Apache, deployed in `/opt/WebHosting`.
|
|
|
|
- `docker-compose.yaml` combines `stacks/<app>/compose.yaml` into one Compose project.
|
|
Run commands from the repository root; relative paths resolve from there.
|
|
- Only Nginx publishes host ports (`80`/`443`) and joins `public` and `backend`.
|
|
Web applications share `backend`; databases use their separate application networks.
|
|
These are bridge networks with outbound access, without `internal: true`.
|
|
- Puppet manages secrets through `hiera/data-lx/default/lx-docker-01.psi.ch.yaml`.
|
|
The service env files live under `/etc/webhosting/`, separately from this repo.
|
|
- Env files are root-owned (`0600`, directories `0700`) and use `format: raw`:
|
|
keep values literal, without adding quotes or escaping dollar signs.
|
|
|
|
Puppet must provision all required env files before Compose validation or deployment.
|
|
Use `config --quiet` to avoid printing secrets. After an update, check the application;
|
|
if its container IP changed, validate and reload Nginx using the host's deployment procedure.
|
|
|
|
Gitea Actions runs linting and Compose syntax checks for PRs. After a merge to
|
|
`main`, it pulls the repo, obtains missing certificates, runs Compose, and
|
|
tests/reloads Nginx. Failed commands stop the job; there is no automatic rollback.
|
|
|
|
For new sites, use `/etc/nginx/certs/<hostname>.crt` and
|
|
`/etc/nginx/private/<hostname>.key` in the Nginx config. CI checks the host's
|
|
`/etc/letsencrypt/live/<hostname>/` for `fullchain.pem` and `privkey.pem`, requesting
|
|
a certificate if either is missing. It uses the existing host ACME config and
|
|
ensures symlinks under `/etc/pki/tls/`, mounted at those Nginx paths in the container.
|
|
It reloads Nginx at the end. Existing certificates keep their normal renewal schedule.
|