deploy: align console ingress and dns contract

deploy_console_svc_plus.yml

@@ -4,6 +4,7 @@
   become: true
   roles:
     - roles/vhosts/docker
+    - roles/vhosts/caddy
     - roles/vhosts/console_service
 
 - name: Sync console DNS records when requested

roles/cloudflare_svc_plus_dns/tasks/main.yml

@@ -8,6 +8,7 @@
     cloudflare_dns_records: >-
       {%- set records = [] -%}
       {%- set source_specs = cloudflare_dns_source_hosts | default(cloudflare_dns_default_source_hosts, true) -%}
+      {%- set static_records = cloudflare_dns_static_records | default([], true) -%}
       {%- set expanded_hosts = [] -%}
       {%- for spec in source_specs -%}
       {%-   for host in query('inventory_hostnames', spec) -%}
@@ -29,6 +30,9 @@
           }) -%}
       {%- endfor -%}
       {%- endfor -%}
+      {%- for static_record in static_records -%}
+      {%-   set _ = records.append(static_record) -%}
+      {%- endfor -%}
       {{ records | to_json | from_yaml }}
 
 - name: Reconcile svc.plus DNS via shared Cloudflare role

roles/vhosts/caddy/templates/Caddyfile.j2

@@ -2,6 +2,8 @@
 	# debug
 }
 
+import /etc/caddy/conf.d/*.caddy
+
 ############################
 # portal.onwalk.net
 # Next.js yarn dev

roles/vhosts/console_service/defaults/main.yml

@@ -6,8 +6,10 @@ console_service_project_name: "{{ lookup('ansible.builtin.env', 'CONSOLE_PROJECT
 console_service_server_name: console
 console_service_release_id: "{{ lookup('env', 'RELEASE_ID') | default(lookup('pipe', 'git -C ' ~ playbook_dir ~ ' rev-parse --short HEAD'), true) }}"
 console_service_hostname: "{{ inventory_hostname | default(ansible_facts['hostname']) | default('unknown-host', true) }}"
-console_service_domain: "{{ lookup('ansible.builtin.env', 'CONSOLE_DOMAIN') | default('console.svc.plus', true) }}"
+console_service_canonical_domain: "{{ lookup('ansible.builtin.vars', 'CANONICAL_DOMAIN', default=lookup('ansible.builtin.env', 'CANONICAL_DOMAIN') | default('console.svc.plus', true)) }}"
-console_service_domain_slug: "{{ console_service_domain | replace('.', '-') }}"
+console_service_served_domains: "{{ lookup('ansible.builtin.vars', 'SERVED_DOMAINS', default=lookup('ansible.builtin.env', 'SERVED_DOMAINS') | default(console_service_canonical_domain, true)) }}"
+console_service_domain: "{{ console_service_canonical_domain }}"
+console_service_domain_slug: "{{ console_service_canonical_domain | replace('.', '-') }}"
 console_service_caddy_conf_dir: /etc/caddy/conf.d
 console_service_caddy_fragment_name: "{{ console_service_server_name }}-{{ console_service_release_id }}-{{ console_service_hostname }}-{{ console_service_domain_slug }}.caddy"
 console_service_caddy_fragment_path: "{{ console_service_caddy_conf_dir }}/{{ console_service_caddy_fragment_name }}"
@@ -24,23 +26,21 @@ console_service_registry: "{{ lookup('ansible.builtin.env', 'CONSOLE_REGISTRY')
 console_service_registry_username: "{{ lookup('ansible.builtin.env', 'GHCR_USERNAME') | default('', true) }}"
 console_service_registry_password: "{{ lookup('ansible.builtin.env', 'GHCR_PASSWORD') | default('', true) }}"
 
-console_service_primary_domain: "{{ lookup('ansible.builtin.env', 'PRIMARY_DOMAIN') | default('cn-console.svc.plus', true) }}"
-console_service_secondary_domain: "{{ lookup('ansible.builtin.env', 'SECONDARY_DOMAIN') | default('cn-console.onwalk.net', true) }}"
-
 console_service_port: "{{ lookup('ansible.builtin.env', 'PORT') | default('3000', true) }}"
 console_service_node_env: production
 console_service_runtime_env: "{{ lookup('ansible.builtin.env', 'RUNTIME_ENV') | default('prod', true) }}"
 console_service_region: "{{ lookup('ansible.builtin.env', 'REGION') | default('cn', true) }}"
-console_service_app_base_url: "{{ lookup('ansible.builtin.env', 'APP_BASE_URL') | default('https://' ~ console_service_primary_domain, true) }}"
+console_service_public_base_url: "{{ lookup('ansible.builtin.env', 'APP_BASE_URL') | default('https://' ~ console_service_canonical_domain, true) }}"
-console_service_next_public_app_base_url: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_APP_BASE_URL') | default(console_service_app_base_url, true) }}"
+console_service_app_base_url: "{{ console_service_public_base_url }}"
-console_service_next_public_site_url: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_SITE_URL') | default(console_service_app_base_url, true) }}"
+console_service_next_public_app_base_url: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_APP_BASE_URL') | default(console_service_public_base_url, true) }}"
-console_service_next_public_login_url: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_LOGIN_URL') | default(console_service_app_base_url ~ '/login', true) }}"
+console_service_next_public_site_url: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_SITE_URL') | default(console_service_public_base_url, true) }}"
-console_service_next_public_docs_base_url: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_DOCS_BASE_URL') | default(console_service_app_base_url ~ '/docs', true) }}"
+console_service_next_public_login_url: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_LOGIN_URL') | default(console_service_public_base_url ~ '/login', true) }}"
+console_service_next_public_docs_base_url: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_DOCS_BASE_URL') | default(console_service_public_base_url ~ '/docs', true) }}"
 console_service_session_cookie_secure: "{{ lookup('ansible.builtin.env', 'SESSION_COOKIE_SECURE') | default('true', true) }}"
 console_service_next_public_session_cookie_secure: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_SESSION_COOKIE_SECURE') | default('true', true) }}"
-console_service_runtime_hostname: "{{ lookup('ansible.builtin.env', 'RUNTIME_HOSTNAME') | default(console_service_primary_domain, true) }}"
+console_service_runtime_hostname: "{{ lookup('ansible.builtin.env', 'RUNTIME_HOSTNAME') | default(console_service_canonical_domain, true) }}"
-console_service_next_runtime_hostname: "{{ lookup('ansible.builtin.env', 'NEXT_RUNTIME_HOSTNAME') | default(console_service_primary_domain, true) }}"
+console_service_next_runtime_hostname: "{{ lookup('ansible.builtin.env', 'NEXT_RUNTIME_HOSTNAME') | default(console_service_canonical_domain, true) }}"
-console_service_deployment_hostname: "{{ lookup('ansible.builtin.env', 'DEPLOYMENT_HOSTNAME') | default(console_service_primary_domain, true) }}"
+console_service_deployment_hostname: "{{ lookup('ansible.builtin.env', 'DEPLOYMENT_HOSTNAME') | default(console_service_hostname, true) }}"
 console_service_next_public_runtime_environment: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_RUNTIME_ENVIRONMENT') | default('prod', true) }}"
 console_service_next_public_runtime_region: "{{ lookup('ansible.builtin.env', 'NEXT_PUBLIC_RUNTIME_REGION') | default('cn', true) }}"
 console_service_account_service_url: "{{ lookup('ansible.builtin.env', 'ACCOUNT_SERVICE_URL') | default('https://accounts.svc.plus', true) }}"

roles/vhosts/console_service/templates/Caddyfile.j2

@@ -1,4 +1,4 @@
-{{ console_service_domain }} {
+{{ '{$SERVED_DOMAINS}' }} {
   encode zstd gzip
 
   reverse_proxy 127.0.0.1:{{ console_service_port }} {

roles/vhosts/console_service/templates/env.runtime.j2

@@ -1,6 +1,6 @@
 FRONTEND_IMAGE={{ console_service_frontend_image }}
-PRIMARY_DOMAIN={{ console_service_domain }}
+CANONICAL_DOMAIN={{ console_service_canonical_domain }}
-SECONDARY_DOMAIN={{ console_service_domain }}
+SERVED_DOMAINS={{ console_service_served_domains }}
 NODE_ENV={{ console_service_node_env }}
 PORT={{ console_service_port }}
 RUNTIME_ENV={{ console_service_runtime_env }}

vars/cloudflare_svc_plus_dns.yml

@@ -3,3 +3,10 @@ cloudflare_dns_default_source_hosts:
   - cn_front_host
   - jp_xhttp_contabo_host
   - tky_proxy_host
+
+cloudflare_dns_static_records:
+  - type: CNAME
+    name: www.svc.plus
+    content: console.svc.plus
+    ttl: 1
+    proxied: false