docs(plan): scrub stale pack subdomain + packwiz from live-arch docs
The pack./packwiz service was removed operationally long ago, but several plan docs still presented pack. as a live caddy vhost / DNS subdomain and render-pack.sh as a current tool. Remove those references from the current-architecture docs (overview, caddy, tooling, uptime-kuma, letsencrypt, mc-backup); leave the migration log (04-mods.md), superseded banner (04-packwiz.md), commit history (12-build-order.md), and planned landing rework (18) intact as deliberate history. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -15,7 +15,7 @@ BASE_DOMAIN=ulicraft.net # all services are subdomains of this
|
||||
|
||||
`render-config.sh` substitutes **only** `${BASE_DOMAIN}` into the templates.
|
||||
DNS is **not** this repo's concern: point `${BASE_DOMAIN}` and all subdomains
|
||||
(`auth.` `pack.` `avatar.` `status.` `distribution.` `www.`) at the host running
|
||||
(`auth.` `avatar.` `status.` `distribution.` `www.`) at the host running
|
||||
nginx; that is configured outside this repo.
|
||||
|
||||
## Subdomain / ingress map
|
||||
@@ -23,7 +23,6 @@ nginx; that is configured outside this repo.
|
||||
```
|
||||
ulicraft.net → nginx → caddy → landing page (/srv/www) + /launcher/
|
||||
auth.ulicraft.net → nginx → caddy → drasl:25585 (auth web UI + Yggdrasil API)
|
||||
pack.ulicraft.net → nginx → caddy → /srv/pack (packwiz pack metadata)
|
||||
avatar.ulicraft.net → nginx → caddy → nmsr:8080 (skin/avatar renderer)
|
||||
status.ulicraft.net → nginx → caddy → uptime-kuma:3001 (status page)
|
||||
distribution.ulicraft.net → nginx → caddy → /srv/distribution (static, another repo)
|
||||
@@ -45,36 +44,35 @@ resolves its own subdomains internally:
|
||||
caddy:
|
||||
networks:
|
||||
mcnet:
|
||||
aliases: [ "auth.${BASE_DOMAIN}", "pack.${BASE_DOMAIN}" ]
|
||||
aliases: [ "auth.${BASE_DOMAIN}" ]
|
||||
```
|
||||
|
||||
Result: `http://auth.ulicraft.net/authlib-injector` and
|
||||
`http://pack.ulicraft.net/pack.toml` resolve identically inside the stack
|
||||
(minecraft → caddy) as the public names do outside it (client → nginx → caddy).
|
||||
Result: `http://auth.ulicraft.net/authlib-injector` resolves identically inside
|
||||
the stack (minecraft → caddy) as the public name does outside it (client → nginx
|
||||
→ caddy).
|
||||
|
||||
#### HTTPS variant (`extra_hosts: host-gateway`)
|
||||
|
||||
The caddy alias only serves **http** on `mcnet` (port 80). Once the stack moved
|
||||
to https URLs (drasl `BaseURL`, `PACKWIZ_URL`, the authlib-injector agent must
|
||||
match the client's https endpoint), the internal http alias is no longer enough —
|
||||
the container needs to reach a **TLS** terminator holding a valid cert.
|
||||
to https URLs (drasl `BaseURL`; the authlib-injector agent must match the
|
||||
client's https endpoint), the internal http alias is no longer enough — the
|
||||
container needs to reach a **TLS** terminator holding a valid cert.
|
||||
|
||||
Caddy does not terminate TLS internally; the host's nginx does (on `0.0.0.0:443`).
|
||||
So pin the public names to the host in the service, not to caddy:
|
||||
So pin the public name to the host in the service, not to caddy:
|
||||
|
||||
```yaml
|
||||
minecraft:
|
||||
extra_hosts:
|
||||
- "auth.${BASE_DOMAIN}:host-gateway"
|
||||
- "pack.${BASE_DOMAIN}:host-gateway"
|
||||
```
|
||||
|
||||
`/etc/hosts` (extra_hosts) wins over the Docker resolver, so the container reaches
|
||||
the host's nginx (valid LE cert) → caddy → service. This is required because
|
||||
**containers do not inherit the host's `/etc/hosts`** — on cochi the host resolves
|
||||
`auth./pack.` to the public IP, but inside a container the LAN resolver returns a
|
||||
dead address (`192.168.0.3:443`, connection refused), which crash-loops the
|
||||
packwiz install on boot. `host-gateway` sidesteps DNS entirely.
|
||||
`auth.` to the public IP, but inside a container the LAN resolver returns a
|
||||
dead address (`192.168.0.3:443`, connection refused), which crash-loops session
|
||||
validation on boot. `host-gateway` sidesteps DNS entirely.
|
||||
|
||||
## Build / run flow
|
||||
|
||||
@@ -83,7 +81,7 @@ PREP (run once, online):
|
||||
1. render configs → tooling/render-config.sh (08-tooling.md)
|
||||
2. build landing page → cd landing && pnpm run build → www/ (09-landing.md)
|
||||
3. download launcher releases → tooling/fetch-launcher.sh (06-launcher.md)
|
||||
4. curate packwiz pack → see 04-packwiz.md
|
||||
4. sync server mods → tooling/sync-server-mods.sh (04-mods.md)
|
||||
5. (TLS) issue Let's Encrypt certs → tooling/issue-letsencrypt.sh (15-letsencrypt.md)
|
||||
6. (ingress) render+install nginx → tooling/render-nginx.sh --install (15-letsencrypt.md)
|
||||
|
||||
@@ -99,8 +97,9 @@ and uptime-kuma.
|
||||
|
||||
- **No OIDC/Keycloak (for now)** — drasl password login. Keycloak left out of
|
||||
this stack's scope. Re-add later if desired.
|
||||
- **packwiz only serves metadata** — `.pw.toml` points at Modrinth/CF CDNs;
|
||||
server and clients fetch jars from there. The internet is assumed present.
|
||||
- **Distribution-fed mods** — the modset's source of truth is the HeliosLauncher
|
||||
distribution repo; clients install the full set, the server loads a filtered
|
||||
`both`/`server` subset from `./server-mods`. See `04-mods.md`.
|
||||
- **Fjord launcher** has authlib-injector built in → no manual JVM agent on
|
||||
clients.
|
||||
- **host nginx in front of caddy** — real Let's Encrypt certs (JVM trusts them
|
||||
@@ -121,7 +120,7 @@ and uptime-kuma.
|
||||
│ └── config.toml # generated (gitignored)
|
||||
├── nmsr/ # avatar renderer config + Dockerfile context
|
||||
├── docker/nmsr/ # nmsr image build context
|
||||
├── pack/ # packwiz source of truth
|
||||
├── server-mods/ # filtered server modset (synced, gitignored)
|
||||
├── launcher/ # vendored Fjord launcher releases (gitignored)
|
||||
├── runtime/ # authlib-injector.jar
|
||||
├── tooling/ # render/fetch/issue scripts (see 08-tooling.md)
|
||||
@@ -135,7 +134,7 @@ and uptime-kuma.
|
||||
|
||||
- `02-caddy.md` — internal router (vhost conf.d snippets) behind host nginx
|
||||
- `03-drasl.md` — auth (password login)
|
||||
- `04-packwiz.md` — modpack source
|
||||
- `04-mods.md` — distribution-fed mod volume + server filtering (supersedes `04-packwiz.md`)
|
||||
- `05-minecraft.md` — itzg NeoForge server
|
||||
- `06-launcher.md` — Fjord launcher fetch + distribution
|
||||
- `07-mc-backup.md` — world backups
|
||||
@@ -150,5 +149,5 @@ and uptime-kuma.
|
||||
|
||||
## Boot/dependency order
|
||||
|
||||
`caddy` (aliases) → `drasl` → `minecraft` (depends on drasl + pack served by
|
||||
caddy) → `mc-backup`. `nmsr` and `uptime-kuma` are always-on and join `mcnet`.
|
||||
`caddy` (aliases) → `drasl` → `minecraft` (depends on drasl) → `mc-backup`.
|
||||
`nmsr` and `uptime-kuma` are always-on and join `mcnet`.
|
||||
|
||||
Reference in New Issue
Block a user