Deploy Fly.io Proxy / deploy (push) Successful in 1m37s

Details

Switch Fly proxy to upstream keepalive pools (#337 )

## Summary

- Replace per-request DNS resolution (variable-based `proxy_pass`) with static `upstream` blocks and `keepalive` connection pools
- Reuses TLS connections through the Tailscale tunnel instead of handshaking per request
- Add `mise run fly-reload` for nginx config reload without full redeploy (re-resolves upstream DNS)

## Trade-off

DNS is resolved at config load, not per-request. If Tailscale Ingress pods get new IPs (restart, reschedule), `mise run fly-reload` is needed. A Grafana alert will be added to detect this.

## Still TODO on this branch

- [ ] Grafana alert for upstream unreachable (triggers fly-reload reminder)
- [ ] Docs pass
- [ ] Deploy from branch and verify latency improvement
- [ ] Changelog fragment

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #337

2026-04-17 16:39:52 -07:00

3.4 KiB

Raw Blame History

title

modified

Service Routing

Services are accessible via three DNS domains with different reachability.

DNS Domains

Domain	Proxy	Reachable From
`*.eblu.me`	flyio-proxy (Fly.io → Tailscale tunnel)	Public internet
`*.ops.eblu.me`	Caddy on indri	k8s pods, docker containers, tailnet clients
`*.tail8d86e.ts.net`	Tailscale MagicDNS	Tailnet clients only

Use *.ops.eblu.me for services that need pod-to-service communication. Use *.eblu.me for services exposed publicly via Fly.io.

Caddy Services (`*.ops.eblu.me`)

DNS points to indri's Tailscale IP. TLS via Let's Encrypt (ACME DNS-01 with Gandi).

Service	URL	Description
Homepage	https://go.ops.eblu.me	Service dashboard
forgejo	https://forge.ops.eblu.me	Git hosting (SSH: 2222)
zot	https://registry.ops.eblu.me	Container registry
grafana	https://grafana.ops.eblu.me	Dashboards
argocd	https://argocd.ops.eblu.me	GitOps CD
prometheus	https://prometheus.ops.eblu.me	Metrics
loki	https://loki.ops.eblu.me	Logs
miniflux	https://feed.ops.eblu.me	RSS reader
kiwix	https://kiwix.ops.eblu.me	Offline Wikipedia
transmission	https://torrent.ops.eblu.me	BitTorrent
teslamate	https://tesla.ops.eblu.me	Tesla logger
navidrome	https://dj.ops.eblu.me	Music streaming
jellyfin	https://jellyfin.ops.eblu.me	Media server
postgresql	pg.ops.eblu.me:5432	Database
mealie	https://meals.ops.eblu.me	Recipe manager
paperless	https://paperless.ops.eblu.me	Document management
[[sifaka	Sifaka]]	https://nas.ops.eblu.me

Public Services (`*.eblu.me`)

DNS CNAMEs point to blumeops-proxy.fly.dev. TLS via Fly.io-managed Let's Encrypt. Traffic tunnels back to the homelab over Tailscale. Only services tagged tag:flyio-target are reachable by the proxy — see flyio-proxy for details.

Service	URL	Description
docs	https://docs.eblu.me	Documentation site
cv	https://cv.eblu.me	CV / resume
forgejo	https://forge.eblu.me	Git hosting (public)

Tailscale-Only Services

Service	URL	Description
Kubernetes	https://k8s.tail8d86e.ts.net	Minikube API

Port Map (Indri)

Port	Service	Protocol	Binding	Notes
443	Caddy	HTTPS	0.0.0.0	Reverse proxy
2222	Caddy L4	TCP	0.0.0.0	SSH proxy to Forgejo
5432	Caddy L4	TCP	0.0.0.0	PostgreSQL proxy
9100	Caddy L4	TCP	0.0.0.0	Sifaka node_exporter proxy
9633	Caddy L4	TCP	0.0.0.0	Sifaka smartctl_exporter proxy
2200	Forgejo SSH	TCP	localhost	Built-in SSH server
3001	Forgejo	HTTP	localhost	Web UI
5050	Zot	HTTP	localhost	Registry API
8096	Jellyfin	HTTP	localhost	Media server
44491	K8s API	HTTPS	0.0.0.0	Minikube API server

gandi - DNS hosting for eblu.me
tailscale - ACL configuration
indri - Where services run
flyio-proxy - Public reverse proxy for *.eblu.me
expose-service-publicly - How to add a new public service

3.4 KiB Raw Blame History