eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions

Add Fly.io public reverse proxy for docs.eblu.me #120

Merged
eblume merged 8 commits from feature/flyio-proxy into main 2026-02-08 02:36:20 -08:00
Conversation 0 Commits 8 Files changed 35 +15 -11
1 changed files with 15 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 494a359606 - Show all commits

Update expose-service-publicly docs to match deployed config

Prev Next 
Remove status line, update code examples to reflect lessons learned:
TUN networking (not userspace), iptables, healthz on default_server,
proxy_ssl_server_name, and preauthorized auth key.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Erich Blume 2026-02-08 02:20:21 -08:00
commit 494a359606

26
docs/how-to/expose-service-publicly.md
View file

@ -11,8 +11,6 @@ id: expose-service-publicly
# Expose a Service Publicly via Fly.io + Tailscale # Expose a Service Publicly via Fly.io + Tailscale
> **Status:** In progress — first target: `docs.eblu.me`.
This guide describes how to expose a BlumeOps service to the public internet This guide describes how to expose a BlumeOps service to the public internet
using a reverse proxy container on [Fly.io](https://fly.io) that tunnels back using a reverse proxy container on [Fly.io](https://fly.io) that tunnels back
to [[indri]] over [[tailscale]]. The approach keeps the home IP hidden, to [[indri]] over [[tailscale]]. The approach keeps the home IP hidden,
@ -146,7 +144,8 @@ COPY --from=docker.io/tailscale/tailscale:stable \
COPY --from=docker.io/tailscale/tailscale:stable \ COPY --from=docker.io/tailscale/tailscale:stable \
/usr/local/bin/tailscale /usr/local/bin/tailscale /usr/local/bin/tailscale /usr/local/bin/tailscale
RUN mkdir -p /var/run/tailscale /var/lib/tailscale RUN mkdir -p /var/run/tailscale /var/lib/tailscale \
&& apk add --no-cache iptables ip6tables
COPY nginx.conf /etc/nginx/nginx.conf COPY nginx.conf /etc/nginx/nginx.conf
COPY start.sh /start.sh COPY start.sh /start.sh
@ -163,8 +162,9 @@ CMD ["/start.sh"]
#!/bin/sh #!/bin/sh
set -e set -e
# Start tailscale in userspace networking mode (no TUN device needed) # Start tailscale daemon. Fly.io runs Firecracker microVMs which support
tailscaled --tun=userspace-networking --statedir=/var/lib/tailscale & # TUN devices natively — no need for --tun=userspace-networking.
tailscaled --statedir=/var/lib/tailscale &
sleep 2 sleep 2
# Authenticate and join tailnet # Authenticate and join tailnet
@ -174,7 +174,7 @@ tailscale up --authkey="${TS_AUTHKEY}" --hostname=flyio-proxy
until tailscale status > /dev/null 2>&1; do sleep 1; done until tailscale status > /dev/null 2>&1; do sleep 1; done
echo "Tailscale connected" echo "Tailscale connected"
# Start nginx # Start nginx — MagicDNS resolves *.tail8d86e.ts.net hostnames
nginx -g "daemon off;" nginx -g "daemon off;"
``` ```
@ -211,6 +211,7 @@ http {
location / { location / {
proxy_pass https://docs.tail8d86e.ts.net; proxy_pass https://docs.tail8d86e.ts.net;
proxy_ssl_verify off; proxy_ssl_verify off;
proxy_ssl_server_name on;
# Cache aggressively — static site only. # Cache aggressively — static site only.
# Do NOT use these settings for dynamic services. # Do NOT use these settings for dynamic services.
@ -228,16 +229,19 @@ http {
add_header X-Cache-Status $upstream_cache_status; add_header X-Cache-Status $upstream_cache_status;
} }
}
# Catch-all: reject unknown hosts, but serve health check
server {
listen 8080 default_server;
location /healthz { location /healthz {
return 200 "ok\n"; return 200 "ok\n";
} }
}
# Catch-all: reject unknown hosts location / {
server { return 444;
listen 8080 default_server; }
return 444;
} }
} }
``` ```