Murat ÖZDEMİR 5ddba7eba4 docs: update production roadmap for HA Vault and shared storage

- Refactor production setup documentation to reflect a 3-node Vault Raft cluster starting from launch.
- Update all paths to use StorageBox mounts for shared state (SWAG config, TLS certs, Monitoring data).
- Switch Nginx configuration convention from proxy-confs to site-confs to align with SWAG's auto-include behavior.
- Standardize TLS private key extensions to .pem.
- Update node failover and recovery facts to include monitoring services.
- Align deployment pipeline instructions with the latest environment variable-driven approach.

2026-05-16 16:18:21 +03:00

2.5 KiB

Raw Blame History

04 — SWAG Nginx Proxy Configs (Prod)

Context

Same template files as test (swag/site-confs/*.conf.tpl), different env vars. The pipeline processes templates with prod-specific subdomain values.

Required env vars (in `.env` on storagebox `prod/secrets/iklim.co/.env.prod`)

API_SUBDOMAIN=api.iklim.co
APIGW_SUBDOMAIN=apigw.iklim.co
RABBITMQ_SUBDOMAIN=rabbitmq.iklim.co
GRAFANA_SUBDOMAIN=grafana.iklim.co
RESTRICTED_IP_1=78.187.87.109
RESTRICTED_IP_2=95.70.151.248

# SWAG storage paths — StorageBox is mounted on all app nodes, shared filesystem
# cert-reloader writes here; Vault reads from this path on every node — no SSH distribution needed
SWAG_CERT_DIR=/mnt/storagebox/ssl
# SWAG config dirs on StorageBox — all three survive node failover without pipeline re-run
SWAG_CONFIG_DIR=/mnt/storagebox/swag/config
SWAG_DNS_CONF_DIR=/mnt/storagebox/swag/dns-conf
SWAG_SITE_CONFS_DIR=/mnt/storagebox/swag/site-confs

Template files (already created in test step 04)

swag/site-confs/default.conf
swag/site-confs/api.conf.tpl
swag/site-confs/apigw.conf.tpl
swag/site-confs/rabbitmq.conf.tpl
swag/site-confs/grafana.conf.tpl

No new files to create — the same templates work for both environments.

Deploy step (handled by pipeline — see `08-deploy-pipeline-update.md`)

set -a; . ./.env; set +a
export RESTRICTED_IP_1="78.187.87.109"
export RESTRICTED_IP_2="95.70.151.248"

mkdir -p "$SWAG_DNS_CONF_DIR" "$SWAG_SITE_CONFS_DIR"

for tpl in swag/site-confs/*.conf.tpl; do
  out="$SWAG_SITE_CONFS_DIR/$(basename "${tpl%.tpl}")"
  envsubst < "$tpl" | sudo tee "$out" > /dev/null
  echo "✅ $out"
done

sudo cp swag/site-confs/default.conf "$SWAG_SITE_CONFS_DIR/default.conf"

With API_SUBDOMAIN=api.iklim.co, the output file $SWAG_SITE_CONFS_DIR/api.conf (/mnt/storagebox/swag/site-confs/api.conf) will contain server_name api.iklim.co; — correct for prod.

Verification

After deploy, on iklim-app-01:

cat /mnt/storagebox/swag/site-confs/api.conf | grep server_name

Expected: server_name api.iklim.co;

docker exec $(docker ps -q -f name=iklimco_swag) nginx -t

Expected: syntax is ok

curl -si https://api.iklim.co/health

Expected: APISIX response with valid *.iklim.co cert.

Notes

Prometheus is intentionally NOT exposed via SWAG. Access it via Grafana (internal connection: http://prometheus:9090) or SSH tunnel.
If additional restricted-access subdomains are needed in the future, create a new swag/site-confs/<name>.conf.tpl following the same pattern.

2.5 KiB Raw Blame History