Merge pull request #147 from picosh/am/light-refactor

Refactor pubsub->pipe

.env.example

@@ -146,19 +146,19 @@ AUTH_DOMAIN=http://auth.dev.pico.sh:3006
 AUTH_ISSUER=pico.sh
 AUTH_WEB_PORT=3000
 
-PUBSUB_CADDYFILE=./caddy/Caddyfile
-PUBSUB_V4=
-PUBSUB_V6=
-PUBSUB_HTTP_V4=$PUBSUB_V4:80
-PUBSUB_HTTP_V6=[$PUBSUB_V6]:80
-PUBSUB_HTTPS_V4=$PUBSUB_V4:443
-PUBSUB_HTTPS_V6=[$PUBSUB_V6]:443
-PUBSUB_SSH_V4=$PUBSUB_V4:22
-PUBSUB_SSH_V6=[$PUBSUB_V6]:22
-PUBSUB_HOST=
-PUBSUB_SSH_PORT=2222
-PUBSUB_WEB_PORT=3000
-PUBSUB_PROM_PORT=9222
-PUBSUB_DOMAIN=pubsub.dev.pico.sh:3001
-PUBSUB_PROTOCOL=http
-PUBSUB_DEBUG=1
+PIPE_CADDYFILE=./caddy/Caddyfile
+PIPE_V4=
+PIPE_V6=
+PIPE_HTTP_V4=$PIPE_V4:80
+PIPE_HTTP_V6=[$PIPE_V6]:80
+PIPE_HTTPS_V4=$PIPE_V4:443
+PIPE_HTTPS_V6=[$PIPE_V6]:443
+PIPE_SSH_V4=$PIPE_V4:22
+PIPE_SSH_V6=[$PIPE_V6]:22
+PIPE_HOST=
+PIPE_SSH_PORT=2222
+PIPE_WEB_PORT=3000
+PIPE_PROM_PORT=9222
+PIPE_DOMAIN=pipe.dev.pico.sh:3001
+PIPE_PROTOCOL=http
+PIPE_DEBUG=1

.github/workflows/build.yml

@@ -41,7 +41,7 @@ jobs:
     needs: test
     strategy:
       matrix:
-        APP: [prose, pastes, imgs, pgs, feeds, pubsub]
+        APP: [prose, pastes, imgs, pgs, feeds, pipe]
     steps:
     - name: Checkout repo
       uses: actions/checkout@v3

Makefile

@@ -58,7 +58,7 @@ bp-%: bp-setup
 	$(DOCKER_BUILDX_BUILD) --build-arg "APP=$*" -t "ghcr.io/picosh/pico/$*-web:$(DOCKER_TAG)" --target release-web .
 .PHONY: bp-%
 
-bp-all: bp-prose bp-pastes bp-imgs bp-feeds bp-pgs bp-auth bp-bouncer bp-pubsub
+bp-all: bp-prose bp-pastes bp-imgs bp-feeds bp-pgs bp-auth bp-bouncer bp-pipe
 .PHONY: bp-all
 
 build-auth:
@@ -74,7 +74,7 @@ build-%:
 	go build -o "build/$*-ssh" "./cmd/$*/ssh"
 .PHONY: build-%
 
-build: build-prose build-pastes build-imgs build-feeds build-pgs build-auth build-pico build-pubsub
+build: build-prose build-pastes build-imgs build-feeds build-pgs build-auth build-pico build-pipe
 .PHONY: build
 
 store-clean:

caddy/Caddyfile.auth

@@ -1,9 +1,4 @@
 {
-	on_demand_tls {
-		ask http://web:3000/check
-		interval 1m
-		burst 10
-	}
 	servers {
 		metrics
 	}
@@ -129,11 +124,3 @@
 		Access-Control-Allow-Headers "*"
 	}
 }
-
-:443 {
-	reverse_proxy web:3000
-	tls {$APP_EMAIL} {
-		on_demand
-	}
-	encode zstd gzip
-}

caddy/Caddyfile.pico

@@ -1,4 +1,4 @@
-{$APP_DOMAIN}, tmp.pico.sh {
+{$APP_DOMAIN} {
   reverse_proxy https://pico-docs-prod.pgs.sh {
     header_up Host pico-docs-prod.pgs.sh
   }

caddy/Caddyfile.pipe

@@ -0,0 +1,54 @@
+{
+	servers {
+		metrics
+	}
+}
+
+*.{$APP_DOMAIN}, {$APP_DOMAIN} {
+	reverse_proxy web:3000
+	tls {$APP_EMAIL} {
+		dns cloudflare {$CF_API_TOKEN}
+		resolvers 1.1.1.1
+	}
+	encode zstd gzip
+
+	header {
+		# disable FLoC tracking
+		Permissions-Policy interest-cohort=()
+
+		# enable HSTS
+		Strict-Transport-Security max-age=31536000;
+
+		# disable clients from sniffing the media type
+		X-Content-Type-Options nosniff
+
+		# clickjacking protection
+		X-Frame-Options DENY
+
+		# keep referrer data off of HTTP connections
+		Referrer-Policy no-referrer-when-downgrade
+
+		Content-Security-Policy "default-src 'self'; img-src * 'unsafe-inline'; style-src * 'unsafe-inline'"
+
+		X-XSS-Protection "1; mode=block"
+	}
+
+	@caddymetrics {
+		host {$APP_DOMAIN}
+		path /_caddy/metrics
+	}
+
+	metrics @caddymetrics {
+		disable_openmetrics
+	}
+
+	@appmetrics {
+		host {$APP_DOMAIN}
+		path /_app/metrics
+	}
+
+	handle @appmetrics {
+		rewrite * /metrics
+		reverse_proxy ssh:9222
+	}
+}

cmd/pipe/ssh/main.go

@@ -0,0 +1,7 @@
+package main
+
+import "github.com/picosh/pico/pipe"
+
+func main() {
+	pipe.StartSshServer()
+}

cmd/pipe/web/main.go

@@ -0,0 +1,7 @@
+package main
+
+import "github.com/picosh/pico/pipe"
+
+func main() {
+	pipe.StartApiServer()
+}

docker-compose.override.yml

@@ -45,24 +45,24 @@ services:
       - ./data/pastes-ssh/data:/app/ssh_data
     ports:
       - "2221:2222"
-  pubsub-web:
+  pipe-web:
     build:
       args:
-        APP: pubsub
+        APP: pipe
       target: release-web
     env_file:
       - .env.example
     ports:
       - "3001:3000"
-  pubsub-ssh:
+  pipe-ssh:
     build:
       args:
-        APP: pubsub
+        APP: pipe
       target: release-ssh
     env_file:
       - .env.example
     volumes:
-      - ./data/pubsub-ssh/data:/app/ssh_data
+      - ./data/pipe-ssh/data:/app/ssh_data
     ports:
       - "2221:2222"
   prose-web: