Matt Johnson
44f0257376
- Authentik -> edge2 CT 105 (Postgres pg_dump/restore; SECRET_KEY carried verbatim; zero-downtime until ~2s cutover) - Multi-block Caddy cutover: auth.echo6.co + notes.echo6.co outpost/forward_auth -> 100.64.0.36:9000 - runbook: add reboot tailscale-before-docker gotcha; clarify dnsmasq must NOT be repointed (points at Caddy host) - source left stopped + intact on Contabo as cold rollback Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1.5 KiB
Executable file
1.5 KiB
Executable file
Expose Service on Contabo
Prerequisites
- Service running in Docker on Contabo
- Port bound to
127.0.0.1only (never0.0.0.0)
Steps
1. Deploy the service
ssh root@100.64.0.6
mkdir -p /opt/<service>
# Create docker-compose.yml with port bound to 127.0.0.1:<port>
docker compose up -d
2. Add DNS record
# On TOC
source /home/zvx/projects/.ref/credentials
godaddy-dns.py add-a echo6.co <service> 5.189.158.149
dig +short <service>.echo6.co @8.8.8.8 # Verify
3. Add Caddy site block
ssh root@100.64.0.6
nano /etc/caddy/Caddyfile
# Add:
# <service>.echo6.co {
# reverse_proxy 127.0.0.1:<port>
# }
caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy
4. Add dnsmasq split DNS entry
ssh root@100.64.0.6
nano /etc/dnsmasq.d/tailscale-dns.conf
# Add:
# address=/<service>.echo6.co/100.64.0.6
systemctl restart dnsmasq
5. Verify
# Public
curl -I https://<service>.echo6.co
# Tailscale
dig +short <service>.echo6.co @100.64.0.6 # Should return 100.64.0.6
6. Update docs
- Update
~/.claude/docs/infrastructure/caddy.mdwith new site block - Update
~/.claude/docs/infrastructure/services.mdwith new service - Add credentials to
/home/zvx/projects/.ref/credentialsif applicable
Checklist
□ Docker container running, port on 127.0.0.1 only
□ GoDaddy DNS → 5.189.158.149
□ Caddy site block added and reloaded
□ dnsmasq entry added and restarted
□ Public access verified
□ Tailscale access verified
□ Docs updated