infrastructure

will.anderson/infrastructure

Fork 0

Commit Graph

Author	SHA1	Message	Date
Will Anderson	b5c7125c13	Roll gitea-proxy pod for SNI fix	2026-05-05 04:42:08 -05:00
Will Anderson	464b33a176	Fix nginx SNI for Cloudflare upstream TLS Without proxy_ssl_server_name on, nginx connects to Cloudflare's IP without SNI, triggering handshake_failure (alert 40). Cloudflare requires SNI to route TLS to the correct origin.	2026-05-05 04:41:46 -05:00
Will Anderson	939e66bfbb	Route runner daemon through nginx CF Access proxy act_runner cannot inject custom HTTP headers, so CF Access blocks its unauthenticated calls to git.neuralplatform.ai. Add a gitea-proxy deployment (nginx:alpine) in the ci namespace that injects the CF Access service-token headers and proxies to https://git.neuralplatform.ai. Both runner secrets now point GITEA_INSTANCE_URL at the in-cluster proxy (http://gitea-proxy.ci.svc.cluster.local:3000). Build containers still clone via SSH through git-ssh-init.sh — unaffected.	2026-05-05 04:17:52 -05:00

Author

SHA1

Message

Date

Will Anderson

b5c7125c13

Roll gitea-proxy pod for SNI fix

2026-05-05 04:42:08 -05:00

Will Anderson

464b33a176

Fix nginx SNI for Cloudflare upstream TLS

Without proxy_ssl_server_name on, nginx connects to Cloudflare's IP
without SNI, triggering handshake_failure (alert 40). Cloudflare requires
SNI to route TLS to the correct origin.

2026-05-05 04:41:46 -05:00

Will Anderson

939e66bfbb

Route runner daemon through nginx CF Access proxy

act_runner cannot inject custom HTTP headers, so CF Access blocks its
unauthenticated calls to git.neuralplatform.ai. Add a gitea-proxy
deployment (nginx:alpine) in the ci namespace that injects the CF
Access service-token headers and proxies to https://git.neuralplatform.ai.

Both runner secrets now point GITEA_INSTANCE_URL at the in-cluster proxy
(http://gitea-proxy.ci.svc.cluster.local:3000). Build containers still
clone via SSH through git-ssh-init.sh — unaffected.

2026-05-05 04:17:52 -05:00

3 Commits