sjat
cb8f924d4b
reverse_proxy is the first built+applied service role; add the per-service records CLAUDE.md/ADR-002/008/017/021 require. Add access__*/backup__* data to defaults as the source of truth (ADR-021/022). reverse_proxy is stateless (ACME certs re-issue via HTTP-01), so it declares backup__state: false with a reason rather than a BACKUP.md (ADR-022 convention). The access__*/backup__* cross-role field names intentionally don't carry the reverse_proxy__ prefix, so each is marked `# noqa: var-naming[no-role-prefix]` (ansible-lint has no per-prefix allowlist; rule stays enabled elsewhere). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
28 lines
1.8 KiB
YAML
28 lines
1.8 KiB
YAML
---
|
|
# Caddy reverse proxy (ADR-024). Vanilla Caddy; TLS via ACME HTTP-01 (public hosts).
|
|
reverse_proxy__base_dir: /opt/services/reverse_proxy
|
|
reverse_proxy__acme_email: admin@example.test
|
|
reverse_proxy__routes: [] # each: {host: x, upstream: "svc:port"} OR {host: x, respond: "text"}
|
|
reverse_proxy__manage: true # set false in Molecule to render without Docker
|
|
|
|
# access__*/backup__* are the ADR-021/022 CROSS-ROLE conventions — shared field names that
|
|
# render ACCESS.md/BACKUP.md and drive /check-access · /check-backup. They intentionally do
|
|
# NOT carry the reverse_proxy__ prefix, so each is marked `# noqa: var-naming[no-role-prefix]`
|
|
# (ansible-lint's role-prefix rule has no per-prefix allowlist; keeping it enabled elsewhere).
|
|
|
|
# Operational-access record (ADR-021) — source of truth for ACCESS.md + /check-access.
|
|
access__service: reverse_proxy # noqa: var-naming[no-role-prefix]
|
|
access__compose_project: reverse_proxy # noqa: var-naming[no-role-prefix]
|
|
access__compose_path: "{{ reverse_proxy__base_dir }}/docker-compose.yml" # noqa: var-naming[no-role-prefix]
|
|
access__containers: [caddy] # noqa: var-naming[no-role-prefix]
|
|
access__log: # noqa: var-naming[no-role-prefix]
|
|
loki_labels: { service: caddy } # intent; Loki/Alloy pipeline is ADR-018 (pending)
|
|
access__api: # noqa: var-naming[no-role-prefix]
|
|
enabled: false
|
|
reason: "Caddy admin API bound to container localhost :2019; never exposed (ADR-020 catalog owns ports)"
|
|
|
|
# Backup contract (ADR-022). Stateless: Caddy's /data holds only ACME account keys +
|
|
# issued certs, which are re-requested automatically on restart via HTTP-01 (no manual
|
|
# steps). Residual risk: Let's Encrypt rate limits on rapid repeated re-issuance.
|
|
backup__service: reverse_proxy # noqa: var-naming[no-role-prefix]
|
|
backup__state: false # noqa: var-naming[no-role-prefix]
|