Repository navigation
Render Domain routes and serve static files from the release (S-003-2..7, S-003-13..15) #162
Description
Builds part of spec S-003, docs/specs/003-domain-routes.md (feature issue #90): the acceptance criteria below. Each needs a test that names its id (test_s003_<k>_..., or a proves: S-003-2 comment line).
This is rendering the routes in cloudfall_nginx_site, the engine inventory's static directories, and the nginx worker's traverse-only access.
- S-003-2: That Domain renders a vhost that
nginx -taccepts, with TLS active and without it, on nginx 1.22.1 and 1.26.3 - S-003-3: Against that vhost,
GET /some/unknown/pathanswers 200 with the fallback file's bytes from<installRoot>/current/web/dist/index.html, andGET /assets/app.jsanswers that file's bytes - S-003-4: Against that vhost,
GET /api/healthis proxied to127.0.0.1:8310and the upstream sees the path/api/health - S-003-5: A static route without
spaFallbackanswers 404 for a path with no matching file - S-003-6: After
cloudfall rollbackof the static route's component,GET /serves the previous release'sindex.htmlwithout re-running the domains playbook or reloading nginx - S-003-7: An existing Domain with only
proxy.upstreamrenders a vhost byte-identical to the one the template on origin/main renders, for TLS active and inactive and both nginx versions - S-003-13: Locations in the rendered vhost appear longest path first, and two Domains with the same routes in different declared order render identical bytes
- S-003-14: After the domains playbook runs, the
www-datauser can read<installRoot>/current/web/dist/index.htmland cannot read<installRoot>/shared/env/<component>.env - S-003-15: The ACME challenge location still renders and serves
/.well-known/acme-challenge/from the webroot on a Domain with routes
Depends on #159
Activity
shipmill-romamo commentedon Oct 30, 2026
Triage: implement. Serves: G-3. A build issue of spec S-003 (
docs/specs/003-domain-routes.md, approved in #99), sub-issue of #90. The criteria above are the scope; each gets a test naming its id. It starts once every issue on itsDepends online has closed.Refuse a data copy the target can't hold before dumping it (S-007-6..…
shipmill-romamo commentedon Oct 30, 2026
The build is in #177: the vhost renders one
locationper route, longest path first; a static route serves<installRoot>/current/<directory>/(withtry_filesforspaFallback), and the nginx worker gets traverse-only access through a POSIX ACL, never the application's group. Anupstream-only Domain renders byte-identical to the origin/main template (golden files for TLS on and off, nginx 1.22.1 and 1.26.3). It also sets spec S-003 tobuiltand closes #90.Trade-offs: the role now installs
aclfor Domains with static routes and needs bootstrap to have run first; release files are served only when the archive's own permissions let others read them (0644/0755 normally). A Domain with routes but no/route has no catch-all location, so an unmatched path gets nginx's default page rather than a 404; the spec doesn't say which. Unverified: no real nginx or ACL ran here (nginx -t, the GET answers, andwww-data's access were checked against a model and stand-ins), so S-003-2..6, 14 and 15 still want a live proving run.This issue closes when #177 merges.
Render Domain routes and serve static files from the release (S-003-2…
shipmill-romamo commentedon Oct 30, 2026
Released in v0.8.0rc12 (pre-release).
A plain install gets it with the next stable release.
If you filed this: react 👍 on this comment once it works for you, or reply if it doesn't.