Erich Blume
bd61da4f85
All checks were successful
Deploy Fly.io Proxy / deploy (push) Successful in 1m20s
## Summary - Health check (`/healthz`) now returns 503 until Tailscale is connected - `start.sh` creates `/tmp/tailscale-ready` sentinel after `tailscale up` succeeds - Fly.io keeps the old machine serving traffic during the ~7s startup window Previously, nginx passed the health check immediately, Fly.io routed traffic to the new machine, but MagicDNS wasn't available yet — causing upstream DNS timeouts and 502s on every request until Tailscale connected. ## Deployment and Testing - [ ] Merge and `fly deploy` from `fly/` directory - [ ] Verify deploy completes with zero 502s (check Grafana docs-apm dashboard) - [ ] Confirm health check transitions from 503 → 200 in `fly logs` Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/131
95 lines
2.9 KiB
Nginx Configuration File
95 lines
2.9 KiB
Nginx Configuration File
worker_processes auto;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# JSON access log for Alloy to tail → Loki + metric extraction
|
|
log_format json_log escape=json
|
|
'{'
|
|
'"time":"$time_iso8601",'
|
|
'"remote_addr":"$remote_addr",'
|
|
'"client_ip":"$http_fly_client_ip",'
|
|
'"request_method":"$request_method",'
|
|
'"request_uri":"$request_uri",'
|
|
'"status":$status,'
|
|
'"body_bytes_sent":$body_bytes_sent,'
|
|
'"request_time":$request_time,'
|
|
'"upstream_response_time":"$upstream_response_time",'
|
|
'"upstream_cache_status":"$upstream_cache_status",'
|
|
'"http_host":"$http_host",'
|
|
'"http_user_agent":"$http_user_agent"'
|
|
'}';
|
|
access_log /var/log/nginx/access.json.log json_log;
|
|
|
|
# Rate limiting zones — define per-service zones as needed
|
|
limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
|
|
|
|
# Proxy cache: 200MB, evict after 24h of no access
|
|
proxy_cache_path /tmp/cache levels=1:2 keys_zone=services:10m
|
|
max_size=200m inactive=24h;
|
|
|
|
# MagicDNS resolver — using a variable in proxy_pass defers upstream DNS
|
|
# resolution to request time, letting nginx start before Tailscale connects.
|
|
# Results are cached for 30s per worker to avoid per-request DNS lookups.
|
|
resolver 100.100.100.100 valid=30s;
|
|
resolver_timeout 5s;
|
|
|
|
# --- docs.eblu.me (static site) ---
|
|
server {
|
|
listen 8080;
|
|
server_name docs.eblu.me;
|
|
|
|
limit_req zone=general burst=20 nodelay;
|
|
|
|
location / {
|
|
set $upstream_docs https://docs.tail8d86e.ts.net;
|
|
proxy_pass $upstream_docs$request_uri;
|
|
proxy_ssl_verify off;
|
|
proxy_ssl_server_name on;
|
|
|
|
# Cache aggressively — static site only.
|
|
# Do NOT use these settings for dynamic services.
|
|
proxy_cache services;
|
|
proxy_cache_valid 200 1d;
|
|
proxy_cache_valid 404 1m;
|
|
proxy_cache_use_stale error timeout updating;
|
|
proxy_cache_lock on;
|
|
|
|
# Prevent cache-busting: ignore query strings and
|
|
# client cache-control headers.
|
|
# Safe for static sites; breaks dynamic services.
|
|
proxy_cache_key $host$uri;
|
|
proxy_ignore_headers Cache-Control Set-Cookie;
|
|
|
|
add_header X-Cache-Status $upstream_cache_status;
|
|
}
|
|
|
|
}
|
|
|
|
# Catch-all: reject unknown hosts, but serve health check
|
|
server {
|
|
listen 8080 default_server;
|
|
|
|
location /healthz {
|
|
if (!-f /tmp/tailscale-ready) {
|
|
return 503 "starting\n";
|
|
}
|
|
return 200 "ok\n";
|
|
}
|
|
|
|
location /stub_status {
|
|
stub_status;
|
|
allow 127.0.0.1;
|
|
deny all;
|
|
}
|
|
|
|
location / {
|
|
return 444;
|
|
}
|
|
}
|
|
}
|