host
64995fafab
- migrations: MIGRATION_TABLES now equals POSTGRES_SCHEMA tables
(uploads, task_attachments, task_followups, environments added);
SEQUENCE_TABLES matches IDENTITY tables; task_followups
sender_task_id column ensured before insert; UNMIGRATED_TABLES
and migration_coverage() report tables with no PG schema instead
of silently skipping them; CLI prints the coverage report.
- deploy: DEFAULT_TEST_SUITES gains deploy/tests (discover -s only,
never package path); regression tests pin the default list.
- monitor: MONITOR_SINGLE_HOST=1 makes the server check single-host;
default stays dual to avoid silent downgrade; server_mode is in
the JSON. Optional fail-only alert outlet (webhook or mail,
default off, alert body is pass/fail JSON only, no secrets).
- backup/rollback: README and restore-drill document what is
recoverable (DB, code) vs not (worktrees, traces, uploads, host
configs); rollback.sh shares the server-unit list and dual-port
health success standard with host_deploy.sh (sync test guards it).
- public entry: Caddyfile uses native {$DOMAIN}/{$ACME_EMAIL}
variables plus a caddy.service template; README documents the
steps and the current BT-nginx production status.
42 lines
1.9 KiB
Caddyfile
42 lines
1.9 KiB
Caddyfile
# 公网入口模板（Caddy 自动证书路径，P2-ops 二选一里选了 Caddy，
|
||
# certbot 路径只是备选、未做成模板）。
|
||
#
|
||
# 只暴露 webhook 与 OAuth 回调，任务/项目/管理 API 不对外。
|
||
#
|
||
# 变量是 Caddy 原生环境变量展开（{$DOMAIN} / {$ACME_EMAIL}），
|
||
# 不是部署时 sed 替换：Caddy 启动时从进程环境读这两个变量，
|
||
# 未设时启动即报错（fail-fast，不会静默跑成空域名）。
|
||
# 部署步骤见 deploy/README.md“公网入口”一节；变量文件示例：
|
||
# /etc/caddy/env（600）：
|
||
# DOMAIN=example.invalid
|
||
# ACME_EMAIL=ops@example.invalid
|
||
# caddy.service 模板（同目录）用 EnvironmentFile 指向该文件。
|
||
#
|
||
# 控制面本身仍只监听 127.0.0.1:8765，不直接对外；Caddy 只做反向代理 + TLS。
|
||
# GitHub webhook 与 OAuth 回调都要求 https 且证书有效，Caddy 的自动证书满足这一点；
|
||
# 自签名证书不行，GitHub 会拒绝送达，浏览器也会拦截 OAuth 回调。
|
||
#
|
||
# 当前生产现状：生产走宝塔 nginx，不是 Caddy；本模板是新机可复现的选项，
|
||
# 不是“生产已切 Caddy”的声明（见 deploy/README.md）。
|
||
|
||
{$DOMAIN} {
|
||
encode gzip
|
||
tls {$ACME_EMAIL}
|
||
|
||
# GitHub webhook：签名校验在控制面做（GITHUB_WEBHOOK_SECRET），Caddy 只转发。
|
||
@github path /webhooks/github
|
||
reverse_proxy @github 127.0.0.1:8765
|
||
|
||
# Slack webhook（目前只有解析，未接执行；先留着入口，执行接通后再用）。
|
||
@slack path /webhooks/slack
|
||
reverse_proxy @slack 127.0.0.1:8765
|
||
|
||
# OAuth 浏览器登录/回调：回调 URL 必须与 OAuth App 里填的完全一致，
|
||
# 即 https://{$DOMAIN}/oauth/<provider>/callback。
|
||
@oauth path /oauth/*
|
||
reverse_proxy @oauth 127.0.0.1:8765
|
||
|
||
# 其余一切（/tasks、/projects、/admin/*、/metrics 等）一律不对公网开放。
|
||
respond "forbidden" 403
|
||
}
|