projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: Angie → nginx + Unbound (DNS Forwarder + Cluster-Split-Horizon)

Browse Source 
Reverse-Proxy von Angie (eigenes APT-Repo) auf nginx (Distro) umgestellt
— vereinfacht Bootstrap (kein angie.software-Repo mehr), reduziert
Offene-Punkte (arm64-Verfügbarkeit entfällt). Neuer Service Unbound
übernimmt zwei Rollen: Caching-Forwarder mit DNSSEC und Cluster-internes
Split-Horizon (Local-Zone eg.cluster, Peer-Adressen aus PG ha_nodes,
Reload via unbound-control). Architektur-Spec §7.5 dokumentiert beide
Rollen + Config-Schichtung.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-08 23:06:56 +02:00
parent cf10bd4072
commit 9f75eec756
12 changed files with 74 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
CLAUDE.md
View File

@@ -57,8 +57,9 @@ ac_search_code(query="<stichworte>", project_id=8, session_name=$(printenv ARCHI
| **UI** | React 19, TypeScript strict, Vite, Ant Design 6, TanStack Query 5 |
| **DB** | PostgreSQL 16 (Distro-Paket), goose-Migrations in `migrations/` |
| **State/HA** | KeyDB Active-Active (Redis-kompatibel) |
| **Proxy/LB** | HAProxy (Distro), Angie (eigenes APT-Repo) |
| **Proxy/LB** | HAProxy (Distro), nginx (Distro) |
| **VPN** | WireGuard (Kernel-Modul ab 5.6, `wireguard-tools`) |
| **DNS** | Unbound (Distro) — Forwarder+Cache mit DNSSEC, Cluster-internes Split-Horizon |
| **FW** | nftables (Distro) |
| **Forward-Proxy** | Squid (Distro) |
| **TLS** | certbot + webroot-Plugin |
@@ -87,7 +88,7 @@ ac_search_code(query="<stichworte>", project_id=8, session_name=$(printenv ARCHI
| `edgeguard-scheduler` | Cron-Jobs (ACME-Renew, Backup, Health) | — | `edgeguard` |
| `edgeguard-ctl` | CLI: `initdb migrate cluster-join promote dump-config` | — | root/edgeguard |
Angie terminiert TLS auf `:443` und proxied an `127.0.0.1:9443`.
nginx terminiert TLS auf `:443` und proxied an `127.0.0.1:9443`.
---
@@ -111,7 +112,7 @@ cd management-ui && bun install && bun run build
```bash
# Abhängigkeiten installieren
sudo apt-get install -y postgresql-16 haproxy angie wireguard-tools squid nftables certbot
sudo apt-get install -y postgresql-16 haproxy nginx wireguard-tools squid unbound nftables certbot
# API starten (ohne systemd, für Entwicklung)
go run ./cmd/edgeguard-api/
@@ -135,9 +136,10 @@ cd management-ui && bun run dev
│ ├── handlers/ # HTTP-Handler (REST)
│ ├── services/ # Business-Logik
│ ├── haproxy/ # Config-Generator
│ ├── angie/ # Config-Generator
│ ├── nginx/ # Config-Generator
│ ├── squid/ # Config-Generator
│ ├── wireguard/ # Config-Generator
│ ├── unbound/ # Config-Generator (Forwarder + Cluster-DNS)
│ ├── firewall/ # nftables-Generator
│ ├── cluster/ # Join/Promote/Peer-Discovery
│ ├── proxy/ # Write-Proxy → Cluster-Primary
@@ -149,8 +151,9 @@ cd management-ui && bun run dev
├── deploy/
│ ├── systemd/ # *.service, *.target, *.timer
│ ├── haproxy/ # haproxy.cfg.tpl
│ ├── angie/ # vhost.conf.tpl, sni-map.tpl
│ ├── nginx/ # vhost.conf.tpl, sni-map.tpl
│ ├── squid/ # squid.conf.tpl
│ ├── unbound/ # unbound.conf.tpl
│ └── nftables/ # ruleset.nft.tpl
├── scripts/
│ ├── apt-repo/ # build-package.sh, publish.sh