From 5c5d194f61e6f803c37c2c2c5abe9863a41e6ea0 Mon Sep 17 00:00:00 2001 From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone> Date: Mon, 21 Sep 2026 16:58:11 +0000 Subject: [PATCH] domain cutover (host side): oc.ci host + recipe-report URLs + cc-ci input to c5106bc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - opencode UI: opencodeUiHost=oc.ci.autonomic.zone with the legacy name kept via the new opencodeUiExtraHosts (dual traefik router rule + nginx serverAliases) during the bake. - networking.hosts: new names pinned, legacy names kept. - recipe-report.py: publish/verify/footer URLs → report.ci.autonomic.zone. - flake.lock: cc-ci input → c5106bc (PR #39 + #40: dual-zone SAN cert, front-door rules, drone rename, harness naming). --- cc-ci-plan/recipe-report.py | 8 ++++---- flake.lock | 8 ++++---- nix/hosts/cc-ci/configuration.nix | 12 ++++++++++-- nix/modules/orchestrator-host.nix | 13 ++++++++++++- 4 files changed, 30 insertions(+), 11 deletions(-) diff --git a/cc-ci-plan/recipe-report.py b/cc-ci-plan/recipe-report.py index 34f9ea4..f114c04 100755 --- a/cc-ci-plan/recipe-report.py +++ b/cc-ci-plan/recipe-report.py @@ -303,7 +303,7 @@ def render(spec_path, out_path): for p in lead.split("\n\n") if p.strip()) body = (_mast() + f'
{_esc(sub)}' - f'report.ci.commoninternet.net{gen}
' + f'report.ci.autonomic.zone{gen}' f'
{lead}
') # 1) the full wire — every recipe, in the agent's recommended priority order (CVEs first); CVEs column. wire = ("The full wire — every recipe, in priority order" if kind == "week" @@ -322,7 +322,7 @@ def render(spec_path, out_path): if s.get("changes"): body += f'

What changed

{_changes(s.get("changes"), repo_url)}' body += (f'') + f'dashboard · archive') open(out_path, "w").write(_page(f"{title} · " + s["date"], body)) print("wrote", out_path) @@ -347,10 +347,10 @@ def publish(html_path, date, kind="week"): for d, k in sorted(set(entries), reverse=True)) idx = _page("The Recipe Report — Archive", _mast() + '
Weekly review of Co-op Cloud recipe upgrades & CI' - 'report.ci.commoninternet.net
' + 'report.ci.autonomic.zone' f'') subprocess.run(["ssh", "cc-ci", f"cat > {HOST_REPORTS}/index.html"], input=idx.encode(), check=True) - print(f"published https://report.ci.commoninternet.net/{page} (+ index)") + print(f"published https://report.ci.autonomic.zone/{page} (+ index)") def main(): diff --git a/flake.lock b/flake.lock index 2715767..76515ba 100644 --- a/flake.lock +++ b/flake.lock @@ -10,11 +10,11 @@ ] }, "locked": { - "lastModified": 1789404337, - "narHash": "sha256-FY5oOz/C6i6Ct6Qe6DqN6nOq+TXCyiZq5Am1LKLpDss=", + "lastModified": 1790009762, + "narHash": "sha256-pg5aOho9rJZmHtuGwiQgaW/uQ01vFb0f6lKsH+BB62o=", "ref": "refs/heads/main", - "rev": "eb5fb826114f2b141dffb270fd36f7a22d1bf343", - "revCount": 1550, + "rev": "c5106bc1eb3bcb1b8056b1f1bd2ed8ae7b652503", + "revCount": 1554, "type": "git", "url": "https://git.autonomic.zone/recipe-maintainers/cc-ci.git" }, diff --git a/nix/hosts/cc-ci/configuration.nix b/nix/hosts/cc-ci/configuration.nix index 3f171c2..0b64691 100644 --- a/nix/hosts/cc-ci/configuration.nix +++ b/nix/hosts/cc-ci/configuration.nix @@ -30,8 +30,10 @@ # Weekly self-update (Tue 03:00 UTC; skips itself while CI is busy; see nix/modules/auto-update.nix). cc-ci-orchestrator.autoUpdate.enable = true; - # The opencode UI: traefik (public 443, the *.ci.commoninternet.net cert) → nginx basic auth. - cc-ci-orchestrator.opencodeUiHost = "oc.ci.commoninternet.net"; + # The opencode UI: traefik (public 443, the dual-zone wildcard cert) → nginx basic auth. + # Domain cutover 2026-09: new name primary; legacy name kept answering during the bake window. + cc-ci-orchestrator.opencodeUiHost = "oc.ci.autonomic.zone"; + cc-ci-orchestrator.opencodeUiExtraHosts = [ "oc.ci.commoninternet.net" ]; cc-ci-orchestrator.opencodeUiTraefikNetwork = "proxy"; # ---- no tailscale on this host (operator 2026-09-07) -------------------------------------- @@ -124,7 +126,13 @@ # This host's own public names resolve to itself regardless of external DNS state (host # processes: the drone runner, the harness, the orchestrator; containers use the resolvers # above). Per-run recipe domains are random and cannot be pinned — those follow public DNS. + # Domain cutover 2026-09: new names pinned; legacy names kept during the bake window. networking.hosts."195.201.88.249" = [ + "ci.autonomic.zone" + "drone.ci.autonomic.zone" + "report.ci.autonomic.zone" + "traefik.ci.autonomic.zone" + "oc.ci.autonomic.zone" "ci.commoninternet.net" "drone.ci.commoninternet.net" "report.ci.commoninternet.net" diff --git a/nix/modules/orchestrator-host.nix b/nix/modules/orchestrator-host.nix index 6e4e806..ab6ed03 100644 --- a/nix/modules/orchestrator-host.nix +++ b/nix/modules/orchestrator-host.nix @@ -62,6 +62,16 @@ in description = "nginx server_name for the opencode web UI (TLS + basic auth)."; }; + opencodeUiExtraHosts = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + description = '' + Extra hostnames routed to the opencode UI alongside opencodeUiHost, rendered as + `||`-joined Host conditions on the same router. Domain cutover 2026-09: the + legacy oc.ci.commoninternet.net keeps answering here during the bake window. + ''; + }; + opencodeUiHtpasswdFile = lib.mkOption { type = lib.types.str; default = "/secrets/nginx/oc-htpasswd"; @@ -216,6 +226,7 @@ SSHCFG recommendedProxySettings = true; virtualHosts.${cfg.opencodeUiHost} = { listen = [ { addr = "0.0.0.0"; port = cfg.opencodeUiBackendPort; } ]; + serverAliases = cfg.opencodeUiExtraHosts; basicAuthFile = cfg.opencodeUiHtpasswdFile; extraConfig = '' # traefik sits on the docker networks (ingress 10.0.0.0/24, gwbridge 172.18.0.0/16) @@ -256,7 +267,7 @@ SSHCFG replicas: 1 labels: - "traefik.enable=true" - - "traefik.http.routers.opencode-ui.rule=Host(`${cfg.opencodeUiHost}`)" + - "traefik.http.routers.opencode-ui.rule=${lib.concatStringsSep " || " (map (h: "Host(`${h}`)") ([ cfg.opencodeUiHost ] ++ cfg.opencodeUiExtraHosts))}" - "traefik.http.routers.opencode-ui.entrypoints=web-secure" - "traefik.http.routers.opencode-ui.tls=true" - "traefik.http.services.opencode-ui.loadbalancer.server.port=${toString cfg.opencodeUiBackendPort}"