aboutsummaryrefslogtreecommitdiff
path: root/cluster
diff options
context:
space:
mode:
authorBaptiste Jonglez <git@bitsofnetworks.org>2024-06-08 16:35:35 +0200
committerBaptiste Jonglez <git@bitsofnetworks.org>2024-06-08 16:35:35 +0200
commitcbb0093f2c6a31a0f2ce3ad1e12f2137f2f18c14 (patch)
treebe166c193ae0cb2cc910da99eba209e24238518f /cluster
parentd4fb14347d13a4a5fe92c18b26172ba58bb7e865 (diff)
downloadnixcfg-cbb0093f2c6a31a0f2ce3ad1e12f2137f2f18c14.tar.gz
nixcfg-cbb0093f2c6a31a0f2ce3ad1e12f2137f2f18c14.zip
staging: garage: Handle *.garage.staging for vhost-style S3 and add on-demand TLS checks
Diffstat (limited to 'cluster')
-rw-r--r--cluster/staging/app/garage/config/garage.toml1
-rw-r--r--cluster/staging/app/garage/deploy/garage.hcl8
2 files changed, 9 insertions, 0 deletions
diff --git a/cluster/staging/app/garage/config/garage.toml b/cluster/staging/app/garage/config/garage.toml
index 6c92bf3..01eb237 100644
--- a/cluster/staging/app/garage/config/garage.toml
+++ b/cluster/staging/app/garage/config/garage.toml
@@ -25,6 +25,7 @@ tls_skip_verify = true
[s3_api]
s3_region = "garage-staging"
api_bind_addr = "0.0.0.0:3990"
+root_domain = ".garage.staging.deuxfleurs.org"
[k2v_api]
api_bind_addr = "0.0.0.0:3993"
diff --git a/cluster/staging/app/garage/deploy/garage.hcl b/cluster/staging/app/garage/deploy/garage.hcl
index 67655e4..7a7b44b 100644
--- a/cluster/staging/app/garage/deploy/garage.hcl
+++ b/cluster/staging/app/garage/deploy/garage.hcl
@@ -84,7 +84,9 @@ job "garage-staging" {
tags = [
"garage-staging-api",
"tricot garage.staging.deuxfleurs.org",
+ "tricot *.garage.staging.deuxfleurs.org",
"tricot-add-header Access-Control-Allow-Origin *",
+ "tricot-on-demand-tls-ask http://garage-staging-admin.service.staging.consul:3909/check",
"tricot-site-lb",
]
port = "s3"
@@ -119,10 +121,16 @@ job "garage-staging" {
name = "garage-staging-web"
tags = [
"garage-staging-web",
+ "tricot * 1",
"tricot *.web.staging.deuxfleurs.org",
"tricot staging.deuxfleurs.org",
"tricot matrix.home.adnab.me/.well-known/matrix/server",
+ "tricot-add-header Strict-Transport-Security max-age=63072000; includeSubDomains; preload",
+ "tricot-add-header X-Frame-Options SAMEORIGIN",
+ "tricot-add-header X-XSS-Protection 1; mode=block",
+ "tricot-add-header X-Content-Type-Options nosniff",
"tricot-add-header Access-Control-Allow-Origin *",
+ "tricot-on-demand-tls-ask http://garage-staging-admin.service.staging.consul:3909/check",
"tricot-site-lb",
]
port = "web"