Deploy browser pre-alpha

2026-07-14 00:50:17 -05:00
parent 37218d9f45
commit f5c5d9f00e
17 changed files with 349 additions and 10 deletions
@@ -0,0 +1,43 @@
+# Browser Pre-Alpha Deployment
+
+The browser build is served at `https://doctor.ranaze.com`. Gitea builds and
+deploys the Web image to the `step3-web` Kubernetes namespace on every push to
+`main`. The service is exposed on NodePort `30089`.
+
+## Cloudflare
+
+Create a proxied `doctor` DNS record that targets the same public endpoint as
+the existing `s3q` and `pauth` records. Keep SSL/TLS mode consistent with those
+working services and redirect HTTP to HTTPS.
+
+## Traefik
+
+Create three routers for `doctor.ranaze.com`, ordered by priority:
+
+1. `Host(`doctor.ranaze.com`) && PathPrefix(`/api/Auth`)` routes to the same
+   backend service used by `pauth.ranaze.com`.
+2. `Host(`doctor.ranaze.com`) && PathPrefix(`/api`)` routes to the Kubernetes
+   nodes on port `30088`, the Questions API NodePort.
+3. `Host(`doctor.ranaze.com`)` routes to the Kubernetes nodes on port `30089`,
+   the Web game NodePort.
+
+Do not strip any prefixes. Give the auth router the highest priority, the
+general API router the next-highest priority, and the Web router the lowest.
+Reuse the existing HTTPS entrypoint, certificate resolver, load-balancing node
+list, and HTTP-to-HTTPS middleware.
+
+## Verification
+
+After DNS and Traefik are configured:
+
+```bash
+curl -fsS https://doctor.ranaze.com/healthz
+curl -i -X OPTIONS https://doctor.ranaze.com/api/Auth/login
+curl -i -X OPTIONS https://doctor.ranaze.com/api/questions/search
+```
+
+The health endpoint must return `ok`. Open the site in a desktop browser and
+verify registration or login, question loading, images, answer submission,
+ratings, and question reporting. Browser requests must remain on
+`doctor.ranaze.com`; requests to `pauth.ranaze.com` or `s3q.ranaze.com` indicate
+that the Web origin resolver did not run.