d-bis/proxmox
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Sankofa consolidated hub operator tooling

Browse Source
This commit is contained in:
defiQUG
2026-04-13 21:41:14 -07:00
parent 49740f1a59
commit b7eebb87b3
42 changed files with 2635 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
config/compose/sankofa-consolidated-runtime.example.yml Normal file
View File

@@ -0,0 +1,15 @@
# Example: API hub container only. Point upstream blocks in
# config/nginx/sankofa-phoenix-api-hub.example.conf to real Phoenix (e.g. :4000) and
# dbis_core (:3000) — on the same host use 127.0.0.1 after colocation, or LAN IPs
# (e.g. 192.168.11.50, 192.168.11.155) during migration.
#
# docker compose -f sankofa-consolidated-runtime.example.yml up -d
services:
api-hub:
image: nginx:1.27-alpine
ports:
- "8080:8080"
volumes:
- ../nginx/sankofa-phoenix-api-hub.example.conf:/etc/nginx/conf.d/default.conf:ro
restart: unless-stopped

8
config/ip-addresses.conf
View File

@@ -273,6 +273,14 @@ SANKOFA_CLIENT_SSO_PORT="${SANKOFA_CLIENT_SSO_PORT:-$SANKOFA_PORTAL_PORT}"
# IP_SANKOFA_DASH="192.168.11.xx"
# SANKOFA_DASH_PORT="${SANKOFA_DASH_PORT:-3000}"
# Optional consolidated non-chain runtime (nginx web hub + API path hub). Defaults below
# match the discrete CT model until you provision hub LXCs and set overrides in .env.
# See docs/02-architecture/SANKOFA_PHOENIX_CONSOLIDATED_FRONTEND_AND_API.md
IP_SANKOFA_WEB_HUB="${IP_SANKOFA_WEB_HUB:-$IP_SANKOFA_PORTAL}"
SANKOFA_WEB_HUB_PORT="${SANKOFA_WEB_HUB_PORT:-$SANKOFA_PORTAL_PORT}"
IP_SANKOFA_PHOENIX_API_HUB="${IP_SANKOFA_PHOENIX_API_HUB:-$IP_SANKOFA_PHOENIX_API}"
SANKOFA_PHOENIX_API_HUB_PORT="${SANKOFA_PHOENIX_API_HUB_PORT:-$SANKOFA_PHOENIX_API_PORT}"
# Gov Portals dev (VMID 7804) — DBIS, ICCC, OMNL, XOM at *.xom-dev.phoenix.sankofa.nexus
IP_GOV_PORTALS_DEV="192.168.11.54"

12
config/nftables/sankofa-phoenix-7800-guard-dport-4000.nft Normal file
View File

@@ -0,0 +1,12 @@
# Optional defense-in-depth on Phoenix API LXC (VMID 7800): reject TCP :4000 from non-loopback
# interfaces. Safe when Apollo binds 127.0.0.1:4000 (no listener on eth0); catches accidental
# 0.0.0.0:4000 bind. Load with: nft -f /path/to/this.nft
#
# Remove: nft delete table inet sankofa_phoenix_guard
table inet sankofa_phoenix_guard {
chain input {
type filter hook input priority -50; policy accept;
meta iifname != "lo" tcp dport 4000 reject with tcp reset
}
}

19
config/nginx/sankofa-api-hub-main.example.conf Normal file
View File

@@ -0,0 +1,19 @@
# Top-level nginx.conf for API hub — copy to /etc/sankofa-phoenix-api-hub/nginx.conf on CT.
# Include path-based site from sankofa-phoenix-api-hub.example.conf under conf.d/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
include /etc/sankofa-phoenix-api-hub/conf.d/*.conf;
}

23
config/nginx/sankofa-hub-main.example.conf Normal file
View File

@@ -0,0 +1,23 @@
# Top-level nginx.conf for systemd ExecStart -c /etc/sankofa-web-hub/nginx.conf
# On CT: install snippets to /etc/sankofa-web-hub/ and include site conf from repo examples.
#
# mkdir -p /etc/sankofa-web-hub/conf.d
# cp repo/config/nginx/sankofa-non-chain-frontends.example.conf /etc/sankofa-web-hub/conf.d/site.conf
# cp repo/config/nginx/sankofa-hub-main.example.conf /etc/sankofa-web-hub/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
include /etc/sankofa-web-hub/conf.d/*.conf;
}

27
config/nginx/sankofa-non-chain-frontends.example.conf Normal file
View File

@@ -0,0 +1,27 @@
# Example: single nginx "web hub" for multiple non-chain hostnames (static roots).
# Copy to an LXC as e.g. /etc/nginx/sites-enabled/sankofa-web-hub.conf and adjust paths.
# TLS: typically terminate at NPM; LAN can stay HTTP to this host.
map $host $sankofa_site_root {
portal.sankofa.nexus /var/www/portal;
admin.sankofa.nexus /var/www/admin;
sankofa.nexus /var/www/corporate;
www.sankofa.nexus /var/www/corporate;
# clients.example.nexus /var/www/clients/example;
default /var/www/default;
}
server {
listen 80;
server_name portal.sankofa.nexus admin.sankofa.nexus sankofa.nexus www.sankofa.nexus;
root $sankofa_site_root;
index index.html;
location / {
try_files $uri $uri/ /index.html;
}
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy strict-origin-when-cross-origin;
}

65
config/nginx/sankofa-phoenix-api-hub.example.conf Normal file
View File

@@ -0,0 +1,65 @@
# Tier-1 API hub: one nginx listener; path-based routes to internal Phoenix + dbis_core.
# Upstreams = loopback on same LXC after you colocate processes, or LAN IPs during migration.
#
# Adjust upstream addresses/ports to match ALL_VMIDS_ENDPOINTS / your compose layout.
upstream sankofa_phoenix_graphql {
server 127.0.0.1:4000;
keepalive 32;
}
upstream dbis_core_rest {
server 127.0.0.1:3000;
keepalive 32;
}
server {
listen 8080;
server_name _;
# Optional: restrict to NPM / LAN source IPs
# allow 192.168.11.0/24;
# deny all;
location = /health {
default_type application/json;
return 200 '{"status":"hub-up"}';
}
location /graphql {
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
proxy_pass http://sankofa_phoenix_graphql;
}
location /graphql-ws {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Accept-Encoding "";
proxy_buffering off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
proxy_pass http://sankofa_phoenix_graphql;
}
location /api/ {
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://dbis_core_rest;
}
location /api-docs {
proxy_pass http://dbis_core_rest;
}
}

14
config/systemd/sankofa-non-chain-web-hub-nginx.service.example Normal file
View File

@@ -0,0 +1,14 @@
[Unit]
Description=Sankofa non-chain web hub (nginx static roots per Host)
After=network.target
[Service]
Type=simple
ExecStartPre=/usr/sbin/nginx -t -c /etc/sankofa-web-hub/nginx.conf
ExecStart=/usr/sbin/nginx -g "daemon off;" -c /etc/sankofa-web-hub/nginx.conf
ExecReload=/usr/sbin/nginx -s reload
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target

16
config/systemd/sankofa-phoenix-api-hub-nginx.service.example Normal file
View File

@@ -0,0 +1,16 @@
[Unit]
Description=Sankofa Phoenix API hub (nginx path router to Phoenix GraphQL + dbis_core REST)
After=network.target
# After=dbis-core.service sankofa-phoenix-api.service
# Uncomment Wants= when subgraphs are on the same host and managed by systemd.
[Service]
Type=simple
ExecStartPre=/usr/sbin/nginx -t -c /etc/sankofa-phoenix-api-hub/nginx.conf
ExecStart=/usr/sbin/nginx -g "daemon off;" -c /etc/sankofa-phoenix-api-hub/nginx.conf
ExecReload=/usr/sbin/nginx -s reload -c /etc/sankofa-phoenix-api-hub/nginx.conf
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target