68 lines
2.6 KiB
Markdown
68 lines
2.6 KiB
Markdown
# Taylor `sms.taylor-co.com` (split DNS) layout
|
||
|
||
If HTTP DNS for a hostname points at the **SMS** public IP (e.g. 134.209.x.x) but the
|
||
`better-argo-tunnels` **tunnel-server** and **Traefik** live on `ingress.nixc.us`, you get
|
||
HTTP 404 on the public URL while the tunnel and routes are actually healthy on ingress.
|
||
|
||
## Install onto `sms` (one shot)
|
||
|
||
From this repo, with SSH to **ingress** and **sms**:
|
||
|
||
```bash
|
||
cd deploy/sms
|
||
export SMS_SSH=root@sms.taylor-co.com
|
||
export INGRESS_SSH=root@ingress.nixc.us
|
||
./bootstrap-to-sms.sh
|
||
```
|
||
|
||
This will:
|
||
|
||
- `scp` the tunnel `authorized_keys` from `ingress` (`/home/tunnel/.ssh/authorized_keys` by default).
|
||
- `scp` the compose files and `Caddyfile.example` to `/opt/taylor-sms-edge/`.
|
||
- **Append** (deduped) those public keys to `/root/.ssh/authorized_keys` on SMS, with a
|
||
timestamped backup of the previous file if one existed. Override with `SMS_KEYS_USER=…`.
|
||
|
||
To use a local file instead of pulling from ingress: `export AUTHORIZED_KEYS_LOCAL=/path/to/keys`.
|
||
|
||
To keep **the same Raspberry Pi tunnel clients and keys** and still use SMS in front:
|
||
|
||
## 1. SSH relay (optional)
|
||
|
||
Run `ssh-relay.compose.yml` on the SMS host so Pis can set:
|
||
|
||
```bash
|
||
TUNNEL_SERVER=sms.taylor-co.com:2222
|
||
```
|
||
|
||
Traffic is forwarded to the real `tunnel-server` (default `ingress.nixc.us:2222`).
|
||
|
||
- Authorize the **same** client public key on **ingress** (`authorized_keys` for the tunnel
|
||
user) — the relay is TCP-only, not another SSH key step.
|
||
|
||
## 2. HTTPS edge (this fixes 404 for names that resolve to SMS)
|
||
|
||
Run `http-edge.compose.yml` with a `Caddyfile` (see `Caddyfile.example`):
|
||
|
||
- Set `INGRESS` to the IP or stable hostname of the Traefik host (`ingress` public IP/hostname).
|
||
- Add one Caddy `server` block per Taylor hostname (e.g. `king73.taylor-co.com`).
|
||
|
||
Caddy gets Let’s Encrypt certs for those names on the **SMS** machine and reverse-proxies to
|
||
`https://$INGRESS`, preserving `Host:`, so Traefik on ingress still matches `Host(\`...\`)` rules.
|
||
|
||
**Security note:** the proxy uses `tls_insecure_skip_verify` to the origin because the
|
||
connection is often IP-based. Restrict network path (same DC/VPC) or pin to a private IP if
|
||
you can.
|
||
|
||
## 3. Simpler alternative
|
||
|
||
Point the Taylor hostnames’ **A/AAAA** at `ingress.nixc.us` and skip the SMS HTTP edge.
|
||
|
||
## Files
|
||
|
||
| File | Role |
|
||
|------|------|
|
||
| `bootstrap-to-sms.sh` | `scp` keys from ingress + these files to `/opt/taylor-sms-edge`, merge keys on SMS |
|
||
| `ssh-relay.compose.yml` | TCP :2222 → upstream tunnel-server |
|
||
| `http-edge.compose.yml` | Caddy on :80 / :443 → Traefik (HTTPS upstream) |
|
||
| `Caddyfile.example` | Template for one hostname; duplicate blocks as needed |
|