ops(deploy): CLOUDFLARED_DIR preflight + fold frontend into core stack#17
Merged
NetworkTheoryAppliedResearchInstitute merged 1 commit intoJul 13, 2026
Merged
Conversation
Two hardening fixes after the 2026-07-13 redeploy outage.
1. redeploy.sh gains a CLOUDFLARED_DIR preflight. The M5 audit replaced a
hardcoded home path with ${CLOUDFLARED_DIR:-./deploy/cloudflared}; when .env
lacks CLOUDFLARED_DIR the recreate mounted the wrong (empty) dir and
cloudflared crash-looped on "tunnel credentials file not found", taking
soholink.org down for ~3 minutes. The preflight aborts the deploy if
CLOUDFLARED_DIR is unset or holds no *.json credential, before any container
is touched.
2. The frontend edge moves from the docker-compose.frontend.yml overlay into
the core stack. It served soholink.org (cloudflared -> frontend:80) from a
separate overlay container that the core lifecycle did not manage; a
docker compose down/up on the core stack would drop the homepage. Now it is
a first-class service, cloudflared depends_on it, and redeploy.sh builds it
alongside portal/orchestrator. Overlay file deleted.
docker compose config parses; redeploy.sh passes sh -n.
Signed-off-by: Jodson Graves <info@ntari.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardening after the 2026-07-13 redeploy outage (#7 of the operator-readiness plan).
1.
redeploy.shCLOUDFLARED_DIR preflight. The M5 audit replaced a hardcoded home path with${CLOUDFLARED_DIR:-./deploy/cloudflared}; when.envlackedCLOUDFLARED_DIR, the recreate mounted the empty default dir and cloudflared crash-looped on tunnel credentials file not found — soholink.org was down ~3 min. The preflight now aborts the deploy (before touching any container) ifCLOUDFLARED_DIRis unset or contains no*.jsoncredential.2. Frontend folded into the core stack. It served the public homepage (
cloudflared → frontend:80) from a separatedocker-compose.frontend.ymloverlay the core lifecycle didn't manage — adocker compose down/upon the core stack would drop the homepage. It's now a first-class service (cloudflareddepends_onit;redeploy.shbuilds it alongside portal/orchestrator). Overlay file removed.Verified:
docker compose configparses with the frontend service rendered;redeploy.shpassessh -n.Author does not self-merge — for review.