2026-06-27 09:43:44 -04:00
|
|
|
# uvlava
|
|
|
|
|
|
|
|
|
|
**uvlava.com — the shared infranet.** The infrastructure layer beneath both
|
|
|
|
|
product lines, replacing the dead homelan hosts `black` + `apricot` (died
|
|
|
|
|
2026-06-27). Not a product; the substrate the products run on.
|
|
|
|
|
|
|
|
|
|
- **lilith (v2)** — `~/Code/@projects/@lilith/lilith-platform.live`
|
|
|
|
|
- **cocotte (v4)** — `~/Code/@projects/@cocottetech`
|
|
|
|
|
|
|
|
|
|
Both consume uvlava; neither owns it. Infra config lives here so it isn't
|
|
|
|
|
buried in a product repo.
|
|
|
|
|
|
|
|
|
|
## Topology
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
PUBLIC INTERNET ─► serve tier (NOT uvlava): 1984.is / vps-0 (Iceland)
|
|
|
|
|
nginx · SPAs · edge cache · mail · adult content
|
|
|
|
|
│ private (WireGuard mesh)
|
|
|
|
|
uvlava ───────────► store/infra tier: DigitalOcean (ct:prod, nyc3)
|
|
|
|
|
Forgejo · Verdaccio · Managed PG · Spaces · workers
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
uvlava is **store/infra only** — it never serves adult content to the public
|
|
|
|
|
(provider-AUP + the serve tier stays on content-tolerant 1984.is).
|
|
|
|
|
|
|
|
|
|
## What's live
|
|
|
|
|
|
2026-06-30 01:15:41 -04:00
|
|
|
| Service | Host | Endpoint |
|
2026-06-27 09:43:44 -04:00
|
|
|
|---|---|---|
|
2026-06-30 01:15:41 -04:00
|
|
|
| Forgejo (git canonical) | ct-forge droplet | `https://forge.ct.uvlava.com` (live, Caddy + LE) |
|
|
|
|
|
| Verdaccio (`@lilith/*` npm) | same droplet | `https://npm.ct.uvlava.com` |
|
2026-06-27 09:43:44 -04:00
|
|
|
|
|
|
|
|
DO account `ct` / project `ct:prod` / region `nyc3`. `uvlava.com` is registered
|
2026-06-30 01:15:41 -04:00
|
|
|
(joker.com) and **delegated to DigitalOcean** — joker.com publishes
|
|
|
|
|
`ns1/ns2/ns3.digitalocean.com` at the `.com` registry (verified 2026-06-30).
|
|
|
|
|
DNS resolves publicly and Caddy auto-provisions Let's Encrypt certs per
|
|
|
|
|
hostname: `forge.ct.uvlava.com` serves `HTTP/2 200` with a valid LE cert
|
|
|
|
|
(`CN=forge.ct.uvlava.com`). Only hostnames explicitly in the zone resolve —
|
|
|
|
|
there is **no wildcard**, so each new subdomain needs its own A record.
|
2026-06-27 09:43:44 -04:00
|
|
|
|
|
|
|
|
## Layout
|
|
|
|
|
|
|
|
|
|
- `terraform/do/` — DO store tier IaC (Managed PG + Spaces + backend droplet +
|
|
|
|
|
WG peer + optional GPU). `init`/`validate`/`plan` verified against the live
|
|
|
|
|
account (13 resources, no GPU); **not yet applied**. See
|
|
|
|
|
[`terraform/do/README.md`](terraform/do/README.md) for the apply guide.
|
|
|
|
|
|
|
|
|
|
## Secrets
|
|
|
|
|
|
|
|
|
|
None in-tree. All under `~/.vault/` (`0600`): `do-pat-ct.token`,
|
|
|
|
|
`forge-admin-quinn.*`. `.gitignore` blocks `*.tfstate` / `*.tfvars`.
|
