lfg2025/botfights
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

arena: switch canonical URL to https://botfights.archipelago-foundation.org (NPM+LE live), enable TRUSTED_PROXY
CI / check (push) Has been cancelled
Details

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Dorian
2026-07-30 21:44:10 -04:00
co-authored by Claude Fable 5
parent a95cadaf9e
commit 4d285f8e93
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.arena.yml
+2 -1
View File
@@ -38,7 +38,8 @@ services:
- NODE_ENV=production - NODE_ENV=production
- PORT=9100 - PORT=9100
- FIGHT_LOOP_ENABLED=true - FIGHT_LOOP_ENABLED=true
- PUBLIC_ARENA_URL=http://146.59.87.168:9100 - PUBLIC_ARENA_URL=https://botfights.archipelago-foundation.org
- TRUSTED_PROXY=1
# Auth — value comes from the host .env, never hardcoded here. # Auth — value comes from the host .env, never hardcoded here.
# Generated on VPS2 with: openssl rand -hex 32 (see docs/arena-deployment.md) # Generated on VPS2 with: openssl rand -hex 32 (see docs/arena-deployment.md)
- JWT_SECRET=${JWT_SECRET} - JWT_SECRET=${JWT_SECRET}
docs/arena-deployment.md
+2 -2
View File
@@ -44,7 +44,7 @@ hardcoded to one server:
| Image | `localhost:3000/lfg2025/botfights:1.1.0` (Gitea registry on the same host; `localhost:3000` resolves without any insecure-registry config because Docker trusts loopback registries by default — this is why the compose file uses `localhost:3000`, not the public `146.59.87.168:3000`, as the image ref) | | Image | `localhost:3000/lfg2025/botfights:1.1.0` (Gitea registry on the same host; `localhost:3000` resolves without any insecure-registry config because Docker trusts loopback registries by default — this is why the compose file uses `localhost:3000`, not the public `146.59.87.168:3000`, as the image ref) |
| Port | **9100** (verified free before binding; now bound — see `ss -tlnp` output in this phase's execution log) | | Port | **9100** (verified free before binding; now bound — see `ss -tlnp` output in this phase's execution log) |
| Data volume | named volume `botfights-arena-data` → `/app/server/data` inside the container (host mountpoint: `docker volume inspect botfights-arena_botfights-arena-data --format '{{.Mountpoint}}'`) | | Data volume | named volume `botfights-arena-data` → `/app/server/data` inside the container (host mountpoint: `docker volume inspect botfights-arena_botfights-arena-data --format '{{.Mountpoint}}'`) |
| **Canonical URL** | **`http://146.59.87.168:9100`** — plain HTTP, no DNS, no TLS (user decision 2026-07-30, see below) | | **Canonical URL** | **`https://botfights.archipelago-foundation.org`** — TLS via nginx-proxy-manager + Let's Encrypt (user created DNS + proxy host 2026-07-30). Raw fallback: `http://146.59.87.168:9100` |
### Why plain HTTP on the raw port (no DNS/TLS this phase) ### Why plain HTTP on the raw port (no DNS/TLS this phase)
@@ -87,7 +87,7 @@ When DNS/TLS is wanted:
(`ssl_forced=1`) — mirrors the existing `demo.`/`source.`/`fips.` hosts. (`ssl_forced=1`) — mirrors the existing `demo.`/`source.`/`fips.` hosts.
3. Change **only** the value every node reads: `ARENA_UPSTREAM_URL` in 3. Change **only** the value every node reads: `ARENA_UPSTREAM_URL` in
`apps/botfights/manifest.yml` (archy repo) from `apps/botfights/manifest.yml` (archy repo) from
`http://146.59.87.168:9100` to `https://arena.archipelago-foundation.org`. `http://146.59.87.168:9100` to `https://botfights.archipelago-foundation.org` — DONE 2026-07-30: the user created the DNS A record and the NPM proxy host with a Let's Encrypt cert; `TRUSTED_PROXY=1` was enabled on the arena at the same time (it now sits behind NPM).
No code change — the reverse-proxy middleware and NIP-98 verification are No code change — the reverse-proxy middleware and NIP-98 verification are
both already origin-independent (path-only URL comparison). both already origin-independent (path-only URL comparison).
4. Optionally keep `:9100` open as a fallback/legacy path, or firewall it 4. Optionally keep `:9100` open as a fallback/legacy path, or firewall it