# Taylor `sms.taylor-co.com` (split DNS) layout

If HTTP DNS for a hostname points at the **SMS** public IP (e.g. 134.209.x.x) but the
`better-argo-tunnels` **tunnel-server** and **Traefik** live on `ingress.nixc.us`, you get
HTTP 404 on the public URL while the tunnel and routes are actually healthy on ingress.

## Install onto `sms` (one shot)

From this repo, with SSH to **ingress** and **sms**:

```bash
cd deploy/sms
export SMS_SSH=root@sms.taylor-co.com
export INGRESS_SSH=root@ingress.nixc.us
./bootstrap-to-sms.sh
```

This will:

- `scp` the tunnel `authorized_keys` from `ingress` (`/home/tunnel/.ssh/authorized_keys` by default).
- `scp` the compose files and `Caddyfile.example` to `/opt/taylor-sms-edge/`.
- **Append** (deduped) those public keys to `/root/.ssh/authorized_keys` on SMS, with a
  timestamped backup of the previous file if one existed. Override with `SMS_KEYS_USER=…`.

To use a local file instead of pulling from ingress: `export AUTHORIZED_KEYS_LOCAL=/path/to/keys`.

To keep **the same Raspberry Pi tunnel clients and keys** and still use SMS in front:

## 1. SSH relay (optional)

Run `ssh-relay.compose.yml` on the SMS host so Pis can set:

```bash
TUNNEL_SERVER=sms.taylor-co.com:2222
```

Traffic is forwarded to the real `tunnel-server` (default `ingress.nixc.us:2222`).

- Authorize the **same** client public key on **ingress** (`authorized_keys` for the tunnel
  user) — the relay is TCP-only, not another SSH key step.

## 2. HTTPS edge (this fixes 404 for names that resolve to SMS)

Run `http-edge.compose.yml` with a `Caddyfile` (see `Caddyfile.example`):

- Set `INGRESS` to the IP or stable hostname of the Traefik host (`ingress` public IP/hostname).
- Add one Caddy `server` block per Taylor hostname (e.g. `king73.taylor-co.com`).

Caddy gets Let’s Encrypt certs for those names on the **SMS** machine and reverse-proxies to
`https://$INGRESS`, preserving `Host:`, so Traefik on ingress still matches `Host(\`...\`)` rules.

**Security note:** the proxy uses `tls_insecure_skip_verify` to the origin because the
connection is often IP-based. Restrict network path (same DC/VPC) or pin to a private IP if
you can.

## 3. Simpler alternative

Point the Taylor hostnames’ **A/AAAA** at `ingress.nixc.us` and skip the SMS HTTP edge.

## Files

| File | Role |
|------|------|
| `bootstrap-to-sms.sh` | `scp` keys from ingress + these files to `/opt/taylor-sms-edge`, merge keys on SMS |
| `ssh-relay.compose.yml` | TCP :2222 → upstream tunnel-server |
| `http-edge.compose.yml` | Caddy on :80 / :443 → Traefik (HTTPS upstream) |
| `Caddyfile.example` | Template for one hostname; duplicate blocks as needed |