Traefik on Alwaldend

Host Bot

Mon, 01 Jan 0001 00:00:00 +0000

Host Bot runs Traefik with mTLS in front of T3 Code. The host firewall blocks direct external access to T3 Code and accepts new connections only on SSH, HTTP, and HTTPS ports.

T3 Code controls permissions per thread. Its Auto mode maps to Codex Auto-review. The managed Codex requirements allow read-only and host-bot permissions with on-request approvals, so threads cannot select Full access or disable approvals. The requirements file only allowlists the host-bot profile; it must not define the profile because T3 Code supplies a per-thread config layer with the same name, and Codex rejects profiles defined by both requirements and config. The normal and isolated provider configs define host-bot with workspace writes, public command-network access, and write access to the Bazel cache and Bazelisk directories while keeping local network binding and loopback connections available for Bazel servers. Other private network targets remain blocked. T3 Code must select that profile for the thread. Hosted web search is not restricted by this role.

ingress

Mon, 01 Jan 0001 00:00:00 +0000

Run ansible

bazel run //infra/ingress/ansible

Services in traefik_services must use a backend target that resolves from the ingress hosts without resolving back to ingress. Define a dedicated site-local address, conventionally prefixed with dc1., in the owning service’s DNS configuration and use that address as the target.

Apply terraform

bazel run //infra/ingress/tf

Update signed image url

Create a signed url: https://yandex.cloud/ru/docs/storage/operations/objects/link-for-download
Update the secret: alwaldend.com/vault1/approles/src_infra_ingress/image

Recreate VMs

bazel run infra/ingress/tf -- -replace 'yandex_compute_disk.vpc["*"]'

Regenerate wireguard keys

Regenerate private and public keys:

wg genkey | tee host1.privatekey.txt | wg pubkey >host1.publickey.txt
wg genkey | tee host2.privatekey.txt | wg pubkey >host2.publickey.txt
wg genkey | tee router.privatekey.txt | wg pubkey >router.publickey.txt
cat - >data.json <<EOF
{
  "wg_public_keys": {
    "host1": "$(cat host1.publickey.txt)",
    "host2": "$(cat host2.publickey.txt)",
    "router": "$(cat router.publickey.txt)"
  },
  "wg_private_keys": {
    "host1": "$(cat host1.privatekey.txt)",
    "host2": "$(cat host2.privatekey.txt)",
    "router": "$(cat router.privatekey.txt)"
  },
  "wg_preshared_keys": {
    "host1": "$(openssl rand 32 | base64)",
    "host2": "$(openssl rand 32 | base64)"
  }
}
EOF
bazel run infra/ingress:vault.kv_put -- -format json alwaldend.com/vault1/approles/src_infra_ingress/wireguard "@${PWD}/data.json"
rm data.json *.privatekey.txt *.publickey.txt

io_traefik_traefik

Mon, 01 Jan 0001 00:00:00 +0000

Traefik

Mon, 01 Jan 0001 00:00:00 +0000

Traefik on Alwaldend

Host Bot

ingress

Run ansible

Apply terraform

Update signed image url

Recreate VMs

Regenerate wireguard keys

io_traefik_traefik

Links

Traefik

Links