From 7a02c50aa91fe45916ecb40ca4908012390b257e Mon Sep 17 00:00:00 2001 From: David Schroeder Date: Sat, 25 Jul 2026 16:18:38 -0500 Subject: [PATCH] update --- .env.example | 2 +- compose.yaml | 2 +- docs/deployment.md | 18 +++++++++++------- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.env.example b/.env.example index af69ca4..e78e74b 100644 --- a/.env.example +++ b/.env.example @@ -1,4 +1,4 @@ -TAPM_LISTEN_ADDR=127.0.0.1:8080 +TAPM_LISTEN_ADDR=0.0.0.0:8080 TAPM_UPDATE_PEERS=10.10.1.122 TAPM_UPDATE_SSH_USER=root TAPM_PUBLIC_URL=https://tapm.scity.us diff --git a/compose.yaml b/compose.yaml index 49e34e5..3a6e520 100644 --- a/compose.yaml +++ b/compose.yaml @@ -22,7 +22,7 @@ services: tmpfs: - /tmp:size=16m,mode=1777 healthcheck: - test: ["CMD-SHELL", "wget -q -O - \"http://${TAPM_LISTEN_ADDR}/health/ready\""] + test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:8080/health/ready"] interval: 30s timeout: 5s retries: 3 diff --git a/docs/deployment.md b/docs/deployment.md index 1b4d7ff..7d7d5d6 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -9,14 +9,18 @@ each webserver's local HAProxy listener. Create `tapm.scity.us` in PowerDNS and point it at the existing HAProxy frontend. Install the certificate using the existing certificate automation. -Set `TAPM_LISTEN_ADDR` to each node's physical address when the load balancer -connects directly to port 8080: +Set the broker to listen on all addresses on both webservers: -- Webserver-Node1: `10.10.1.121:8080` -- Webserver-Node2: `10.10.1.122:8080` +```dotenv +TAPM_LISTEN_ADDR=0.0.0.0:8080 +``` -Restrict port 8080 to the load-balancer addresses. If Nginx terminates TLS on -each webserver instead, keep the broker on `127.0.0.1:8080`. +The wildcard bind accepts connections through each node's physical address and +through the Keepalived address `10.10.1.120` on whichever node currently owns +it. The container health check independently uses `127.0.0.1:8080`. Restrict +port 8080 to the load-balancer and trusted management addresses. If Nginx +terminates TLS locally and neither direct nor Keepalived access is required, +the broker can instead bind to `127.0.0.1:8080`. An example virtual host is in [`deploy/nginx/tapm.scity.us.conf`](../deploy/nginx/tapm.scity.us.conf). @@ -111,7 +115,7 @@ On both webservers: ```sh docker compose up -d broker -curl --fail "http://${TAPM_LISTEN_ADDR}/health/ready" +curl --fail "http://127.0.0.1:8080/health/ready" ``` There is no local application state and no session affinity requirement.