From 85883acc17cd8cb987d61650fac611734c6d1de3 Mon Sep 17 00:00:00 2001 From: Scott Karp Date: Tue, 13 Oct 2026 22:44:33 +0000 Subject: [PATCH] =?UTF-8?q?the=20place:=20bikoret.ch=20=E2=80=94=20Ingress?= =?UTF-8?q?=20hosts,=20TLS,=20and=20the=20.org=20redirect?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bikoret.ch and www.bikoret.ch served with a Let's Encrypt certificate through cert-manager (letsencrypt-prod, HTTP-01), ssl-redirect on; bikoret.org and www redirect permanently to https://bikoret.ch; the no-host catch-all stays; shorashim.ch still answers over plain HTTP until its callers have moved. KOHEN Day 8 gives the order: A records, wait for the name to resolve, then apply — never before. Tamid's names table updated. Doorpost re-pinned. Co-Authored-By: Claude Fable 5.1 --- KOHEN.md | 2 +- deploy/k8s/service.yaml | 90 +++++++++++++++++++---- specs/bikoret_tamid.md | 2 +- vav_pipeline/lib/vav_pipeline/doorpost.ex | 2 +- 4 files changed, 80 insertions(+), 16 deletions(-) diff --git a/KOHEN.md b/KOHEN.md index c96f92ca..1149b3b5 100644 --- a/KOHEN.md +++ b/KOHEN.md @@ -463,7 +463,7 @@ kubectl logs -n shorashim deploy/bikoret -c vav-pipeline -f If the seven days passed without halt events, without Shabbat violations, without manna exhaustion, without any pod restarts: -1. **Point DNS** — `shorashim.ch` A record to the ingress IP (`kubectl get svc -n ingress-nginx ingress-nginx-controller`; `185.19.28.170`). Then add the TLS block noted in `deploy/k8s/service.yaml` — until then `` is that IP over plain HTTP +1. **Point DNS** — at the registrar, A records to the ingress IP (`kubectl get svc -n ingress-nginx ingress-nginx-controller`; `185.19.28.170`): `bikoret.ch`, `www.bikoret.ch`, and for the redirect `bikoret.org`, `www.bikoret.org`. Wait until `dig +short A bikoret.ch` answers the IP — only then `kubectl apply -f deploy/k8s/service.yaml`: it carries the TLS blocks (cert-manager, `letsencrypt-prod`, HTTP-01), and a certificate asked for before the name resolves burns Let's Encrypt's failed-validation limit. Then `kubectl -n shorashim get certificate` until both are Ready, and callers use `https://bikoret.ch`; `shorashim.ch` still answers over plain HTTP until its callers have moved 2. **Open the pe'ah endpoint to the world** — the stranger approaches first 3. **Observe the first real interaction** — a question from outside 4. If *ki tov*: open courtyard and chatzer endpoints. The system is consecrated. diff --git a/deploy/k8s/service.yaml b/deploy/k8s/service.yaml index 482961a4..574828bc 100644 --- a/deploy/k8s/service.yaml +++ b/deploy/k8s/service.yaml @@ -37,18 +37,14 @@ spec: # controller sees the caller and hands it on in X-Real-IP; the pipeline # believes that header only from TRUSTED_PROXIES (configmap.yaml). # -# Two rules, one backend: -# - no host → the catch-all: http:///... works with no DNS -# - shorashim.ch → ready for the A record (KOHEN.md Day 8). TLS is NOT -# requested here: asking cert-manager for a certificate before the -# name resolves only burns Let's Encrypt's failed-validation limit. -# When the record exists add: -# metadata.annotations: -# cert-manager.io/cluster-issuer: letsencrypt-prod -# nginx.ingress.kubernetes.io/ssl-redirect: "true" -# spec.tls: [{hosts: [shorashim.ch], secretName: shorashim-tls}] -# and point callers at https://shorashim.ch — until then the -# courtyard keys travel over plain HTTP. +# Hosts (2026-10-13, the name): bikoret.ch is the place; www.bikoret.ch +# and the old shorashim.ch are served too; bikoret.org (second Ingress +# below) only redirects. TLS from Let's Encrypt through cert-manager's +# letsencrypt-prod ClusterIssuer, HTTP-01 — so apply this ONLY after +# `dig +short A bikoret.ch` answers 185.19.28.170: a certificate asked +# for before the name resolves only burns the failed-validation limit. +# The no-host catch-all stays, so http:///... keeps working +# with no DNS; with ssl-redirect on, named hosts go to https. apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -57,15 +53,21 @@ metadata: labels: app.kubernetes.io/name: shorashim annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod # A 71-judge Sanhedrin may deliberate for ten minutes (Construction §2.2). nginx.ingress.kubernetes.io/proxy-read-timeout: "620" nginx.ingress.kubernetes.io/proxy-send-timeout: "620" # The bedikah accepts 65,536 bytes of output and 1 MiB of sources; # leave room for the envelope. nginx.ingress.kubernetes.io/proxy-body-size: "2m" - nginx.ingress.kubernetes.io/ssl-redirect: "false" + nginx.ingress.kubernetes.io/ssl-redirect: "true" spec: ingressClassName: nginx + tls: + - hosts: + - bikoret.ch + - www.bikoret.ch + secretName: bikoret-tls rules: - http: paths: @@ -76,6 +78,27 @@ spec: name: shorashim port: number: 80 + - host: bikoret.ch + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: shorashim + port: + number: 80 + - host: www.bikoret.ch + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: shorashim + port: + number: 80 + # The old name, kept until its callers have moved; no certificate asked for it. - host: shorashim.ch http: paths: @@ -86,3 +109,44 @@ spec: name: shorashim port: number: 80 +--- +# bikoret.org: the stranger's guess, redirected to the place. No service +# of its own; nginx answers the redirect itself. Add its A records too. +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: bikoret-org + namespace: shorashim + labels: + app.kubernetes.io/name: shorashim + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch$request_uri +spec: + ingressClassName: nginx + tls: + - hosts: + - bikoret.org + - www.bikoret.org + secretName: bikoret-org-tls + rules: + - host: bikoret.org + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: shorashim + port: + number: 80 + - host: www.bikoret.org + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: shorashim + port: + number: 80 diff --git a/specs/bikoret_tamid.md b/specs/bikoret_tamid.md index f6628889..93c462cb 100644 --- a/specs/bikoret_tamid.md +++ b/specs/bikoret_tamid.md @@ -377,7 +377,7 @@ and why, until the kohen moves it: |---|---|---| | Kubernetes | namespace `shorashim`; Deployment/Service/Ingress `shorashim`; labels `app.kubernetes.io/name: shorashim`; Secrets `shorashim-secrets`, `shorashim-migrate-secrets`, `shorashim-api-keys`, `shorashim-registry`; ConfigMap `shorashim-config` | A Deployment's selector is immutable and a namespace cannot be renamed: moving them is a delete-and-recreate with the secrets re-issued by the kohen (the builder cannot copy secrets). Do it as one cut-over, at a quiet hour, with the manna written first | | PostgreSQL | role `shorashim_app`; databases `shorashim` | An existing role in the managed database; renaming it is the kohen's DDL (`ALTER ROLE … RENAME`) and a rotation of `DATABASE_URL` in both secrets | -| DNS | `shorashim.ch`, `mcp.shorashim.ch`, the issuer mail | The transmitter's domain; whether `bikoret.ch` is taken, bought and pointed is his decision — the Ingress host rule follows it | +| DNS | `shorashim.ch` (still served, no certificate), `mcp.shorashim.ch`, the issuer mail | `bikoret.ch` and `bikoret.org` were registered 2026-10-13; the Ingress serves `bikoret.ch` + `www` with TLS and redirects `.org` to it (`deploy/k8s/service.yaml`, KOHEN Day 8). The old host stays until its callers have moved | | Builder's machine | `~/shorashim` (symlink to `~/bikoret`), `~/shorashim-source-data`, `~/shorashim-operator-notes`, `~/.local/bin/shorashim-rollout` (its name is in a permission rule) | Local paths; the symlink keeps every script and memory pointer working | | Gitea | `heaviness510/bikoret` (renamed; the old URL redirects) | — | diff --git a/vav_pipeline/lib/vav_pipeline/doorpost.ex b/vav_pipeline/lib/vav_pipeline/doorpost.ex index 21515ca6..4c1fceef 100644 --- a/vav_pipeline/lib/vav_pipeline/doorpost.ex +++ b/vav_pipeline/lib/vav_pipeline/doorpost.ex @@ -180,7 +180,7 @@ defmodule VavPipeline.Doorpost do # changes; the update is a deliberate operator commit. A bare # hash-update commit (without a corresponding spec change in the # same commit) is itself a drift signal. - @expected_hash "c963c4fe5076ec713ae12f07618e2606788b1a6b706a426800fab6a0fdd1bcfa" + @expected_hash "10735ab4e4280bf35d19d6ed79804c31d5ef199a70a289f455e138085e9cba5d" @doc "Return the list of files that constitute the category-grade specification." @spec files() :: [String.t()]