mc/mc-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add MCR routes to rift mc-proxy config

Browse Source 
SNI-multiplexed routes for mcr.svc.mcp.metacircular.net on all three
listeners: L7 web on :443, L4 API on :8443, L4 gRPC on :9443.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-03-25 22:03:46 -07:00
parent c13c868e77
commit af8cebd97e
1 changed files with 27 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
deploy/mc-proxy-rift.toml
View File

@@ -1,16 +1,16 @@
# mc-proxy configuration for rift. # mc-proxy configuration for rift.
# #
# Fronts metacrypt containers: # Fronts metacrypt, mcr, and sgard containers:
# :443 → metacrypt-web (L7, TLS termination + re-encrypt) # :443 → metacrypt-web, mcr-web (L7, TLS termination + re-encrypt)
# :8443 → metacrypt API (L4 passthrough) # :8443 → metacrypt API, mcr API (L4 passthrough, SNI-multiplexed)
# :9443 → metacrypt gRPC (L4 passthrough) # :9443 → metacrypt gRPC, mcr gRPC, sgardd (L4 passthrough, SNI-multiplexed)
# #
# Copy to /srv/mc-proxy/mc-proxy.toml on rift before starting. # Copy to /srv/mc-proxy/mc-proxy.toml on rift before starting.
[database] [database]
path = "/srv/mc-proxy/mc-proxy.db" path = "/srv/mc-proxy/mc-proxy.db"
# :443 — L7 TLS-terminating route to metacrypt web UI. # :443 — L7 TLS-terminating routes to web UIs.
[[listeners]] [[listeners]]
addr = ":443" addr = ":443"
@@ -22,7 +22,15 @@ addr = ":443"
tls_key = "/srv/mc-proxy/certs/metacrypt-svc.key" tls_key = "/srv/mc-proxy/certs/metacrypt-svc.key"
backend_tls = true backend_tls = true
# :8443 — L4 passthrough to metacrypt API (already serves TLS). [[listeners.routes]]
hostname = "mcr.svc.mcp.metacircular.net"
backend = "127.0.0.1:28080"
mode = "l7"
tls_cert = "/srv/mc-proxy/certs/mcr-svc.pem"
tls_key = "/srv/mc-proxy/certs/mcr-svc.key"
backend_tls = true
# :8443 — L4 passthrough, SNI-multiplexed: metacrypt API + mcr API.
[[listeners]] [[listeners]]
addr = ":8443" addr = ":8443"
@@ -30,7 +38,11 @@ addr = ":8443"
hostname = "metacrypt.svc.mcp.metacircular.net" hostname = "metacrypt.svc.mcp.metacircular.net"
backend = "127.0.0.1:18443" backend = "127.0.0.1:18443"
# :9443 — L4 passthrough to metacrypt gRPC (already serves TLS). [[listeners.routes]]
hostname = "mcr.svc.mcp.metacircular.net"
backend = "127.0.0.1:28443"
# :9443 — L4 passthrough, SNI-multiplexed: metacrypt gRPC + mcr gRPC + sgardd.
[[listeners]] [[listeners]]
addr = ":9443" addr = ":9443"
@@ -38,6 +50,14 @@ addr = ":9443"
hostname = "metacrypt.svc.mcp.metacircular.net" hostname = "metacrypt.svc.mcp.metacircular.net"
backend = "127.0.0.1:19443" backend = "127.0.0.1:19443"
[[listeners.routes]]
hostname = "mcr.svc.mcp.metacircular.net"
backend = "127.0.0.1:29443"
[[listeners.routes]]
hostname = "sgard.svc.mcp.metacircular.net"
backend = "127.0.0.1:19473"
# gRPC admin API — Unix socket, secured by file permissions. # gRPC admin API — Unix socket, secured by file permissions.
[grpc] [grpc]
addr = "/srv/mc-proxy/mc-proxy.sock" addr = "/srv/mc-proxy/mc-proxy.sock"