Erich Blume
6e37abda5d
Adds the Adelaide / Heidi / Addie baby shower app — a Django guest
splash, raffle picker, and prize-assignment console — on ringtail k3s.
Public landing at shower.eblu.me (via fly proxy), tailnet admin at
shower.ops.eblu.me. App source: forge.eblu.me/eblume/adelaide-baby-shower-app,
wheel-published to the Forgejo Packages PyPI index.
Manifests under argocd/manifests/shower/: NFS-backed PVC for /app/media,
local-path PVC for SQLite, ExternalSecret pulling DJANGO_SECRET_KEY from
1Password (item "Shower (blumeops)"), Tailscale ProxyGroup ingress.
Defense-in-depth for the public surface:
- /admin/ blocked at the fly edge except /admin/login/ and /admin/logout/
- shower_auth rate limit on the login path
- new fail2ban filter+jail with a per-service shower-deny.conf
(nginx-deny action generalized to accept nginx_deny_file)
- django-axes (5 / 1h) keyed on (username, ip_address)
Plus: Caddy route on indri, Pulumi gandi CNAME, Grafana APM dashboard
mirroring docs-apm.json, runbook at how-to/operations/shower-app.md,
and a service-versions entry. X-Clacks-Overhead set on the new server
block — GNU Terry Pratchett.
Build: containers/shower/default.nix uses dockerTools to ship a
nixpkgs Python plus a startup wrapper that installs the wheel into
/app/data/.venv on first boot and execs gunicorn. Lets the wheel come
from forge PyPI without pinning hashes for every transitive dep.
Prerequisites tracked in the runbook (not yet executed):
- NFS share sifaka:/volume1/shower (manual Synology step)
- 1Password item "Shower (blumeops)" with secret-key field
- container build via `mise run container-build-and-release shower`
- Pulumi dns-up after merge
- fly certs add shower.eblu.me
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
105 lines
3 KiB
Python
105 lines
3 KiB
Python
"""Pulumi program to manage eblu.me DNS via Gandi LiveDNS.
|
|
|
|
This program manages DNS records for blumeops infrastructure:
|
|
- Wildcard record for *.ops.eblu.me pointing to indri's Tailscale IP
|
|
- indri hosts Caddy as the reverse proxy for all services
|
|
- This allows services to be accessed via real DNS names while remaining
|
|
tailnet-only (Tailscale IPs are not publicly routable)
|
|
|
|
Authentication:
|
|
Set GANDI_PERSONAL_ACCESS_TOKEN environment variable.
|
|
See docs/how-to/configuration/rotate-gandi-pat.md for PAT management.
|
|
"""
|
|
|
|
import os
|
|
import socket
|
|
|
|
import pulumi
|
|
import pulumiverse_gandi as gandi
|
|
|
|
# Get configuration
|
|
config = pulumi.Config()
|
|
domain = config.require("domain") # eblu.me
|
|
subdomain = config.require("subdomain") # ops
|
|
|
|
# Resolve indri's Tailscale IP dynamically via MagicDNS
|
|
# This script runs on the tailnet, so we can resolve the hostname directly.
|
|
# indri hosts Caddy, which reverse-proxies all services.
|
|
# Break-glass: set BLUMEOPS_REVERSE_PROXY_IP env var to override DNS resolution
|
|
REVERSE_PROXY_HOST = "indri.tail8d86e.ts.net"
|
|
tailscale_ip = os.environ.get("BLUMEOPS_REVERSE_PROXY_IP") or socket.gethostbyname(
|
|
REVERSE_PROXY_HOST
|
|
)
|
|
|
|
# Wildcard A record for *.ops.eblu.me
|
|
# Points to indri's Tailscale IP, which is only routable within the tailnet.
|
|
# This allows containers and other systems to resolve real DNS names
|
|
# while keeping services private to the tailnet.
|
|
wildcard_record = gandi.livedns.Record(
|
|
"ops-wildcard",
|
|
zone=domain,
|
|
name=f"*.{subdomain}",
|
|
type="A",
|
|
ttl=300,
|
|
values=[tailscale_ip],
|
|
)
|
|
|
|
# Base subdomain record (ops.eblu.me) - same IP
|
|
base_record = gandi.livedns.Record(
|
|
"ops-base",
|
|
zone=domain,
|
|
name=subdomain,
|
|
type="A",
|
|
ttl=300,
|
|
values=[tailscale_ip],
|
|
)
|
|
|
|
# ============== Public Services (Fly.io proxy) ==============
|
|
# CNAME records pointing public subdomains to Fly.io for reverse proxying
|
|
# back to the tailnet. See docs/how-to/expose-service-publicly.md
|
|
|
|
docs_public = gandi.livedns.Record(
|
|
"docs-public",
|
|
zone=domain,
|
|
name="docs",
|
|
type="CNAME",
|
|
ttl=300,
|
|
values=["blumeops-proxy.fly.dev."],
|
|
)
|
|
|
|
cv_public = gandi.livedns.Record(
|
|
"cv-public",
|
|
zone=domain,
|
|
name="cv",
|
|
type="CNAME",
|
|
ttl=300,
|
|
values=["blumeops-proxy.fly.dev."],
|
|
)
|
|
|
|
forge_public = gandi.livedns.Record(
|
|
"forge-public",
|
|
zone=domain,
|
|
name="forge",
|
|
type="CNAME",
|
|
ttl=300,
|
|
values=["blumeops-proxy.fly.dev."],
|
|
)
|
|
|
|
shower_public = gandi.livedns.Record(
|
|
"shower-public",
|
|
zone=domain,
|
|
name="shower",
|
|
type="CNAME",
|
|
ttl=300,
|
|
values=["blumeops-proxy.fly.dev."],
|
|
)
|
|
|
|
# ============== Exports ==============
|
|
pulumi.export("domain", domain)
|
|
pulumi.export("wildcard_fqdn", f"*.{subdomain}.{domain}")
|
|
pulumi.export("base_fqdn", f"{subdomain}.{domain}")
|
|
pulumi.export("target_ip", tailscale_ip)
|
|
pulumi.export("docs_public_fqdn", f"docs.{domain}")
|
|
pulumi.export("cv_public_fqdn", f"cv.{domain}")
|
|
pulumi.export("forge_public_fqdn", f"forge.{domain}")
|
|
pulumi.export("shower_public_fqdn", f"shower.{domain}")
|