Public web access for infraternal.kayg.org #253

New issue

Closed

opened 2026-10-22 14:41:27 +00:00 by kayg · 1 comment

kayg commented

2026-10-22 14:41:27 +00:00

Owner

Owner request 2026-10-22 (~20:10 IST): make infraternal reachable from public traffic; DNS infraternal.kayg.org now points to monitor01's public IP 37.157.255.66.

Done 14:40 UTC (20:10 IST):

/opt/infra/traefik/dynamic/infraternal.yml: removed the infraternal-netbird-only ipAllowList (10.69.69.0/24). Backup: /opt/infra/traefik/infraternal.yml.before-public-20261022-144050. Rollback = copy it back (Traefik watches the directory).
No server restart (CA stays as it was).
The infraternal agent port 7443 stays on NetBird only (10.69.69.50:7443), as D64 says.

Verified from a non-NetBird source (168.119.145.115, routed via eth0):

/healthz 200   / 200   /v1/ws 400 (no upgrade, expected)
http:// → 308 https://
cert CN=infraternal.kayg.org, Let's Encrypt YR2, notAfter Jan 2 2027

The Traefik access log shows the real public client IP.

Owner request 2026-10-22 (~20:10 IST): make infraternal reachable from public traffic; DNS infraternal.kayg.org now points to monitor01's public IP 37.157.255.66. Done 14:40 UTC (20:10 IST): - `/opt/infra/traefik/dynamic/infraternal.yml`: removed the `infraternal-netbird-only` ipAllowList (10.69.69.0/24). Backup: `/opt/infra/traefik/infraternal.yml.before-public-20261022-144050`. Rollback = copy it back (Traefik watches the directory). - No server restart (CA stays as it was). - The infraternal agent port 7443 stays on NetBird only (10.69.69.50:7443), as D64 says. Verified from a non-NetBird source (168.119.145.115, routed via eth0): ``` /healthz 200 / 200 /v1/ws 400 (no upgrade, expected) http:// → 308 https:// cert CN=infraternal.kayg.org, Let's Encrypt YR2, notAfter Jan 2 2027 ``` The Traefik access log shows the real public client IP.

kayg referenced this issue

2026-10-28 17:50:46 +00:00

Orchestrator handover 2026-10-28: moving to a new machine #254

kayg commented

2026-10-28 17:53:29 +00:00

Author

Owner

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Public web access completed and verified on 2026-10-22 (Traefik allowlist removed, agent port stays NetBird-only). Reopen if anything is still missing.

kayg closed this issue

2026-10-28 17:53:29 +00:00

~~kayg referenced this issue 2026-10-28 17:53:55 +00:00~~

Orchestrator handover 2026-10-28: moving to a new machine #254

No labels

launch-qa

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal#253

No description provided.

Rows
Columns