From 2045b32a0118683b82c4301a3ebd1227e9f4b583 Mon Sep 17 00:00:00 2001 From: David Schroeder Date: Sat, 25 Jul 2026 13:21:34 -0500 Subject: [PATCH] update --- .env.example | 4 ++-- compose.yaml | 4 ++-- docs/deployment.md | 28 ++++++++++++++++++---------- 3 files changed, 22 insertions(+), 14 deletions(-) diff --git a/.env.example b/.env.example index 0764df0..8032f08 100644 --- a/.env.example +++ b/.env.example @@ -1,6 +1,6 @@ -TAPM_LISTEN_ADDR=:8080 +TAPM_LISTEN_ADDR=127.0.0.1:8080 TAPM_PUBLIC_URL=https://tapm.scity.us -TAPM_DATABASE_DSN=tapm:change-me@tcp(galera.example.internal:3306)/tapm_broker?parseTime=true&charset=utf8mb4&collation=utf8mb4_unicode_ci&multiStatements=true&time_zone=%27%2B00%3A00%27 +TAPM_DATABASE_DSN=tapm:change-me@tcp(127.0.0.1:3306)/tapm_broker?parseTime=true&charset=utf8mb4&collation=utf8mb4_unicode_ci&multiStatements=true&time_zone=%27%2B00%3A00%27 TAPM_GITEA_URL=https://git.scity.us TAPM_GITEA_CLIENT_ID=replace-me TAPM_GITEA_CLIENT_SECRET=replace-me diff --git a/compose.yaml b/compose.yaml index 0228c83..a4782b9 100644 --- a/compose.yaml +++ b/compose.yaml @@ -4,12 +4,14 @@ services: image: tai/tapm-deployment-broker:local entrypoint: ["/usr/local/bin/tapm-migrate"] env_file: .env + network_mode: host restart: "no" broker: build: . image: tai/tapm-deployment-broker:local env_file: .env + network_mode: host restart: unless-stopped init: true read_only: true @@ -19,8 +21,6 @@ services: - ALL tmpfs: - /tmp:size=16m,mode=1777 - ports: - - "127.0.0.1:8080:8080" healthcheck: test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8080/health/ready"] interval: 30s diff --git a/docs/deployment.md b/docs/deployment.md index ca2bd21..9559417 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -2,7 +2,9 @@ This service is intended to run on both webserver VMs, with only the active webserver's broker container started. Both installations use the same MariaDB -Galera database, Gitea application, package registry, and secrets. +Galera database, Gitea application, package registry, and secrets. The +containers use Linux host networking so `127.0.0.1:3306` reaches each +webserver's local HAProxy listener. ## 1. DNS and TLS @@ -16,21 +18,27 @@ Adjust only the certificate paths if the local convention differs. ## 2. MariaDB Galera -Create a dedicated database and least-privilege application user. Run this once -against the cluster as a database administrator: +Create a dedicated database and application users limited to the two webserver +addresses. Run this once against the cluster as a database administrator, +replacing the password with the same locally generated value in both accounts: ```sql CREATE DATABASE tapm_broker CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; -CREATE USER 'tapm'@'10.%' IDENTIFIED BY 'replace-with-a-random-password'; +CREATE USER 'tapm'@'10.10.1.121' IDENTIFIED BY 'replace-with-a-random-password'; +CREATE USER 'tapm'@'10.10.1.122' IDENTIFIED BY 'replace-with-a-random-password'; GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, REFERENCES - ON tapm_broker.* TO 'tapm'@'10.%'; + ON tapm_broker.* TO 'tapm'@'10.10.1.121'; +GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, REFERENCES + ON tapm_broker.* TO 'tapm'@'10.10.1.122'; FLUSH PRIVILEGES; ``` -Restrict the host pattern further if the two webserver addresses are known. -The application does not need global privileges. +The Keepalived address `10.10.1.120` is not included because outbound HAProxy +connections normally originate from the physical webserver address. Add a +third account for `10.10.1.120` only if a connection test or the HAProxy +configuration proves that it explicitly uses the virtual address as its source. ## 3. Gitea accounts and OAuth @@ -66,9 +74,9 @@ openssl rand -base64 48 ``` The database DSN must retain `parseTime=true`, `multiStatements=true`, and the -encoded UTC `time_zone` setting from `.env.example`. -Set the Galera address to an existing database VIP or load-balanced endpoint, -not a single cluster member. +encoded UTC `time_zone` setting from `.env.example`. Its address remains +`127.0.0.1:3306`, which uses the local HAProxy frontend rather than selecting a +single Galera member. ## 5. Build and migrate