waldson/central-proxy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 001-droplet-groundwork-swap-firewall-dns

Browse source
This commit is contained in:
Waldson Patrício 2026-07-23 13:26:46 -03:00
commit 657288bd86
1 changed files with 72 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

72
README.md
View file

@ -71,6 +71,78 @@ Bring the proxy up (or recreate it after a compose change) from that directory:
docker compose up -d
```
## Droplet groundwork
Baseline host configuration for the droplet (`wloud`, 174.138.36.232,
2 GB RAM, 2 vCPUs, 58 GB disk). Everything below was set up once and only
needs revisiting when the host changes.
### Swap
The droplet has 2 GB RAM and no swap by default; a 2 GB swapfile prevents
Out Of Memory (OOM) kills during on-droplet builds and daemon memory spikes.
It is created once with (requires sudo):
```sh
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
echo 'vm.swappiness=10' | sudo tee /etc/sysctl.d/99-swappiness.conf
sudo sysctl -p /etc/sysctl.d/99-swappiness.conf
```
The fstab entry makes it survive reboots; swappiness 10 keeps the kernel from
swapping eagerly. Verify with `free -m` (~2048 total swap) and, after a
reboot, `swapon --show`.
### Firewall
`ufw` is installed and active on the host. Probing from outside the droplet
(2026-07-23) showed no filtering in the path for the service ports: 2222/tcp
and 22000/tcp answered "connection refused" while nothing listened, which
means packets reach the host, so neither ufw nor a DigitalOcean cloud
firewall blocks them. Ports in use:
| Port | Proto | Service |
|-----------|---------|--------------------------------|
| 22 | tcp | host sshd |
| 80, 443 | tcp | Caddy (all HTTP/HTTPS traffic) |
| 2222 | tcp | Forgejo git-over-SSH |
| 22000 | tcp+udp | Syncthing sync protocol |
If ufw rules are ever tightened, keep the four rows above allowed. To
re-verify reachability from any machine outside the droplet:
```sh
nc -vz 174.138.36.232 2222
nc -vz 174.138.36.232 22000
nc -vzu 174.138.36.232 22000
```
"Connection refused" means the port is reachable but nothing listens yet;
only a timeout indicates a filter.
### DNS
All records live on the DigitalOcean nameservers (ns1-3.digitalocean.com)
and point at the droplet:
| Record | Type | Value | Serves |
|--------------------|------|-----------------|----------------------|
| waldson.com.br | A | 174.138.36.232 | personal site |
| www.waldson.com.br | A | 174.138.36.232 | redirect to apex |
| git.waldson.com.br | A | 174.138.36.232 | Forgejo |
| sync.waldson.com.br| A | 174.138.36.232 | Syncthing GUI |
personaledson.com.br and nazareonline.com.br also resolve here for the
existing stacks. Check resolution with:
```sh
dig +short waldson.com.br www.waldson.com.br git.waldson.com.br sync.waldson.com.br
```
## Notes
- `letsencrypt/acme.json` is leftover state from an earlier Traefik-based proxy