feat(infra): lex.<domain> the standard way — stack.toml subdomain, generated coredns host, $multi router, landing tile and health probe

Replaces the hand-written lex routers with one $multi entry (git:3000, git-sso + lex-page + no-cache); lex-page now rewrites every lex path to the dossier page so Gitea's own pages never appear there.
2026-11-12 18:04:44 -05:00
parent 37fb8d2d68
commit 045b99daed
5 changed files with 19 additions and 72 deletions
--- a/infra/coredns/hosts
+++ b/infra/coredns/hosts
@@ -20,3 +20,4 @@
 192.168.1.192 bcda.fhirworx.io
 192.168.1.192 lead.fhirworx.io
 192.168.1.192 reach.fhirworx.io
+192.168.1.192 lex.fhirworx.io
--- a/infra/nginx/index.html
+++ b/infra/nginx/index.html
@@ -93,6 +93,16 @@
                <div class="stripe"></div>
            </a>

+            <a data-subdomain="lex" target="_blank" class="tile notebook">
+                <span class="icon" aria-hidden="true"><svg><use href="#i-chart-area-line"/></svg></span>
+                <div class="tile-eyebrow">LEX</div>
+                <div class="tile-title">Code-family dossiers</div>
+                <p class="tile-desc">Legal-epidemiology workbench for CMS payment and quality rules</p>
+                <span class="health health-unknown"><span class="health-k">health</span><span class="health-v">checking</span></span>
+                <span class="tile-port"></span>
+                <div class="stripe"></div>
+            </a>
+
            <a data-subdomain="traefik" target="_blank" class="tile proxy">
                <span class="icon" aria-hidden="true"><svg><use href="#i-route"/></svg></span>
                <div class="tile-eyebrow">Networking</div>
--- a/infra/nginx/nginx.conf
+++ b/infra/nginx/nginx.conf
@@ -41,6 +41,7 @@ http {
        location = /healthz/bcda       { set $up bcda:8501;       rewrite ^ /_stcore/health break;      proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
        location = /healthz/lead       { set $up lead:8501;       rewrite ^ /_stcore/health break;      proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
        location = /healthz/reach      { set $up lead:8501;       rewrite ^ /_stcore/health break;      proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
+        location = /healthz/lex        { set $up git:3000;        rewrite ^ /assets/dossier/index.html break; proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
        location = /healthz/traefik    { set $up traefik:8080;    rewrite ^ /api/version break;         proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
        location = /healthz/s3console  { set $up rustfs:9001;     rewrite ^ /health break;              proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
        location = /healthz/git        { set $up git:3000;        rewrite ^ /api/healthz break;         proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
--- a/infra/traefik/dynamic/services.yml
+++ b/infra/traefik/dynamic/services.yml
@@ -22,6 +22,7 @@
  "rustfs-api"         (dict "container" "rustfs" "port" "9000" "subdomain" "s3"        "theme" false "mw" "git-sso,infra-headers")
  "rustfs-console"     (dict "container" "rustfs" "port" "9001" "subdomain" "s3console" "theme" true  "mw" "git-sso,infra-headers")
  "reach"              (dict "container" "lead"  "port" "8501" "subdomain" "reach"     "theme" false "mw" "git-sso,secure-headers")
+  "lex"                (dict "container" "git"   "port" "3000" "subdomain" "lex"       "theme" false "mw" "git-sso,lex-page,dossier-nocache,secure-headers")
 -}}
 http:
  middlewares:
@@ -68,10 +69,12 @@ http:
      headers:
        customResponseHeaders:
          Cache-Control: "no-cache"
-    # lex.<domain> (the dossier app): "/" is the static page Gitea serves.
+    # lex.<domain> (the dossier app): every path serves the static page Gitea
+    # holds in custom/public, so Gitea's own pages never appear on lex.
    lex-page:
-      replacePath:
-        path: "/assets/dossier/index.html"
+      replacePathRegex:
+        regex: "^/.*$"
+        replacement: "/assets/dossier/index.html"
    # Anything else on lex, and the old git.<domain>/dossier address, goes
    # to the lex root. Matches every URL, so these routers never fall
    # through to a service.
@@ -181,74 +184,6 @@ http:
        - git-sso
        - dossier-nocache
        - secure-headers
-    # lex.<domain>: the dossier app (legal-epidemiology workbench). Only "/"
-    # and /assets/dossier/ reach Gitea; every other path redirects to "/"
-    # through noop@internal, so Gitea's own pages never appear on lex.
-    lex:
-      rule: "Host(`lex.{{ $domain }}`) && Path(`/`)"
-      priority: 1000
-      service: git
-      entryPoints:
-        - web
-      middlewares:
-        - git-sso
-        - lex-page
-        - dossier-nocache
-        - secure-headers
-    lex-tls:
-      rule: "Host(`lex.{{ $domain }}`) && Path(`/`)"
-      priority: 1000
-      service: git
-      entryPoints:
-        - websecure
-      tls: {}
-      middlewares:
-        - git-sso
-        - lex-page
-        - dossier-nocache
-        - secure-headers
-    lex-assets:
-      rule: "Host(`lex.{{ $domain }}`) && PathPrefix(`/assets/dossier/`)"
-      priority: 1000
-      service: git
-      entryPoints:
-        - web
-      middlewares:
-        - git-sso
-        - dossier-nocache
-        - secure-headers
-    lex-assets-tls:
-      rule: "Host(`lex.{{ $domain }}`) && PathPrefix(`/assets/dossier/`)"
-      priority: 1000
-      service: git
-      entryPoints:
-        - websecure
-      tls: {}
-      middlewares:
-        - git-sso
-        - dossier-nocache
-        - secure-headers
-    lex-other:
-      rule: "Host(`lex.{{ $domain }}`)"
-      priority: 10
-      service: noop@internal
-      entryPoints:
-        - web
-      middlewares:
-        - git-sso
-        - to-lex
-        - secure-headers
-    lex-other-tls:
-      rule: "Host(`lex.{{ $domain }}`)"
-      priority: 10
-      service: noop@internal
-      entryPoints:
-        - websecure
-      tls: {}
-      middlewares:
-        - git-sso
-        - to-lex
-        - secure-headers
    {{- range $name, $svc := $reef }}
    {{ $name }}:
      rule: "Host(`{{ get $svc "subdomain" | default $name }}.{{ $domain }}`){{ range get $svc "extra_hosts" | default list }} || Host(`{{ . }}`){{ end }}"
--- a/stack.toml
+++ b/stack.toml
@@ -24,7 +24,7 @@ subdomains = [
    "dashboard", "docs", "git", "ci", "notebooks", "zotero",
    "webdav", "api", "nessie", "trino", "polaris",
    "grafana", "prometheus", "tempo", "loki",
-    "s3", "s3console", "llm", "bcda", "lead", "reach",
+    "s3", "s3console", "llm", "bcda", "lead", "reach", "lex",
 ]

 [services]