Deploy Fly.io Proxy / deploy (push) Successful in 1m28s

Details

Expose Forgejo publicly at forge.eblu.me (#278 )

## Summary

Expose Forgejo publicly at `forge.eblu.me` via the Fly.io reverse proxy — the first dynamic, authenticated public-facing service.

- **Forgejo hardening:** Domain changed to forge.eblu.me, SSH stays on forge.ops.eblu.me, reverse proxy trust headers configured, local registration locked to external-only (Authentik SSO)
- **Tailscale Ingress:** ExternalName Service + Ingress in tailscale-operator creates forge.tail8d86e.ts.net endpoint
- **Fly.io proxy:** nginx server block with rate-limited auth endpoints (3r/s), fail2ban with custom nginx-deny action, security headers, /swagger blocked, WebSocket support, 512m body limit
- **Authentik:** OAuth callback updated to forge.eblu.me
- **DNS/TLS:** CNAME record in Pulumi, cert in fly-setup
- **Rename:** ~29 files updated from forge.ops.eblu.me to forge.eblu.me (HTTPS refs only; SSH, container builds, and Caddy table kept as-is)

## Deployment Order

1. `mise run provision-indri -- --tags forgejo` (config changes)
2. Verify forge.ops.eblu.me still works
3. `argocd app set tailscale-operator --revision feature/forge-public && argocd app sync tailscale-operator`
4. Verify `curl https://forge.tail8d86e.ts.net`
5. `cd fly && fly deploy`
6. Verify pre-DNS: `curl -H "Host: forge.eblu.me" https://blumeops-proxy.fly.dev/`
7. `fly certs add forge.eblu.me -a blumeops-proxy`
8. `argocd app set authentik --revision feature/forge-public && argocd app sync authentik`
9. `mise run dns-preview && mise run dns-up`
10. Full verification (see below)
11. Rehearse `mise run fly-shutoff`
12. After merge: reset ArgoCD revisions to main, re-sync

## Verification Checklist

- [ ] forge.eblu.me loads, shows public repos
- [ ] forge.ops.eblu.me still works from tailnet
- [ ] SSH clone via forge.ops.eblu.me:2222 works
- [ ] HTTPS clone via forge.eblu.me works
- [ ] UI shows forge.eblu.me for HTTPS clone, forge.ops.eblu.me for SSH
- [ ] /swagger returns 403
- [ ] Rapid login attempts trigger 429 rate limit
- [ ] fail2ban bans after 5 failed logins in 10 minutes
- [ ] ArgoCD can still sync (SSH unaffected)
- [ ] `mise run fly-shutoff` stops all public traffic
- [ ] `mise run services-check` passes

Reviewed-on: #278

2026-03-03 08:40:41 -08:00

3.2 KiB

Raw Blame History

title

modified

Service Routing

Services are accessible via three DNS domains with different reachability.

DNS Domains

Domain	Proxy	Reachable From
`*.eblu.me`	flyio-proxy (Fly.io → Tailscale tunnel)	Public internet
`*.ops.eblu.me`	Caddy on indri	k8s pods, docker containers, tailnet clients
`*.tail8d86e.ts.net`	Tailscale MagicDNS	Tailnet clients only

Use *.ops.eblu.me for services that need pod-to-service communication. Use *.eblu.me for services exposed publicly via Fly.io.

Caddy Services (`*.ops.eblu.me`)

DNS points to indri's Tailscale IP. TLS via Let's Encrypt (ACME DNS-01 with Gandi).

Service	URL	Description
Homepage	https://go.ops.eblu.me	Service dashboard
forgejo	https://forge.ops.eblu.me	Git hosting (SSH: 2222)
zot	https://registry.ops.eblu.me	Container registry
grafana	https://grafana.ops.eblu.me	Dashboards
argocd	https://argocd.ops.eblu.me	GitOps CD
prometheus	https://prometheus.ops.eblu.me	Metrics
loki	https://loki.ops.eblu.me	Logs
miniflux	https://feed.ops.eblu.me	RSS reader
kiwix	https://kiwix.ops.eblu.me	Offline Wikipedia
transmission	https://torrent.ops.eblu.me	BitTorrent
teslamate	https://tesla.ops.eblu.me	Tesla logger
navidrome	https://dj.ops.eblu.me	Music streaming
jellyfin	https://jellyfin.ops.eblu.me	Media server
postgresql	pg.ops.eblu.me:5432	Database
[[sifaka	Sifaka]]	https://nas.ops.eblu.me

Public Services (`*.eblu.me`)

DNS CNAMEs point to blumeops-proxy.fly.dev. TLS via Fly.io-managed Let's Encrypt. Traffic tunnels back to the homelab over Tailscale. Only services tagged tag:flyio-target are reachable by the proxy — see flyio-proxy for details.

Service	URL	Description
docs	https://docs.eblu.me	Documentation site
forgejo	https://forge.eblu.me	Git hosting (public)

Tailscale-Only Services

Service	URL	Description
Kubernetes	https://k8s.tail8d86e.ts.net	Minikube API

Port Map (Indri)

Port	Service	Protocol	Binding	Notes
443	Caddy	HTTPS	0.0.0.0	Reverse proxy
2222	Caddy L4	TCP	0.0.0.0	SSH proxy to Forgejo
5432	Caddy L4	TCP	0.0.0.0	PostgreSQL proxy
9100	Caddy L4	TCP	0.0.0.0	Sifaka node_exporter proxy
9633	Caddy L4	TCP	0.0.0.0	Sifaka smartctl_exporter proxy
2200	Forgejo SSH	TCP	localhost	Built-in SSH server
3001	Forgejo	HTTP	localhost	Web UI
5050	Zot	HTTP	localhost	Registry API
8096	Jellyfin	HTTP	localhost	Media server
44491	K8s API	HTTPS	0.0.0.0	Minikube API server

gandi - DNS hosting for eblu.me
tailscale - ACL configuration
indri - Where services run
flyio-proxy - Public reverse proxy for *.eblu.me
expose-service-publicly - How to add a new public service

3.2 KiB Raw Blame History