Flux Domain Manager

Flux Domain Manager (FDM) manages domains, certificates and load balancing for entire Flux network as well as for applications running on Flux network. FDM in its basics is HAProxy configurator connected to Flux network.

Flux Team is running FDM on runonflux.io domain and is automatically managed on cloudflare and pDNS solution. Anyone can stand up its own FDM on any domain with default settings providing own cloudflare API keys or pDNS keys.

FDM scans Flux network, every healthy node on Flux network is put into FDM for both HOME.yourroot.domain (providing UI) and API.yourroot.domain (providing API endpoints to entire Flux).

Furthermore FDM load balances all applications running on Flux network putting them begind YOURAPPNAME.app.yourroot.domain. If an application has more ports, applications lives on YOURAPPNAME_PORT.app.yourroot.domain in order of how ports were registered on Flux application specifications.

Enable automateCertificatesForFDMdomains flag in config if you want certificate management to be happening for automated domains generated by FDM. Default false.

Enable automateCertificates flag in config if you want certificate management to be happening for custom domains set by an application. Default true.

domainAppType: 'CNEME' or 'A'

• FDM can create either CNAME records or A record of an application. In case of using CNAME record type (default), records will be pointed to fdmAppDomain.

• provide domain

• provide ssl

• load balancing

• Frontend (UI) for Flux network

• API for Flux network

• custom domains

• health checks of applications

• fully automated

• pDNS/Cloudflare

• letsencrypt, certbot, auto cert renewal

Operator alerts

FDM posts to a Discord webhook when it keeps the current haproxy config instead of publishing a new one:

• spec-refused - the app spec list from the Flux API was malformed, or more than 30% smaller than the last accepted one, for longer than 2 minutes
• config-refused:G / config-refused:nonG - a config pass computed a half more than 30% smaller than the one it last published, for longer than 2 minutes

A list more than 30% smaller than the last accepted one, an empty list included, is published once every result for 10 minutes has been that small. With nothing accepted before, a list needs at least 5 entries, or the same 10 minutes. The last accepted sizes are kept in /var/lib/flux-domain-manager/list-guards.json, so a restart is judged against them.

• haproxy-reload - three consecutive reloads did not bring up a new haproxy worker; the message names each port that failed to bind and the socket holding it

Each condition sends one message when it starts and one when it clears. Set alerts.discordWebhookUrl in config. The ansible playbooks render it from the DISCORD_WEBHOOK_URL environment variable, which the deploy workflow sets from the repository secret of the same name; -e discord_webhook_url=... overrides it for a manual run. It never goes in a tracked file. Empty sends nothing. Thresholds are in config/guardsConfig.json.

Application Overview

Prerequisites:

• Nodejs 14+
• haproxy
• mongodb 4+
• certbot
• letsencrypt

Install FDM dependencies (Ubuntu/CentOS/Redhat):

cd Flux

npm install

To run this as Production:

npm start

Application will run on port 16130

Guide for ubuntu 20.04

---

sudo apt update
sudo apt upgrade
sudo apt-get install software-properties-common certbot haproxy curl git wget screen -y
wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm
nvm install 14
nvm use 14
wget -qO - https://www.mongodb.org/static/pgp/server-4.4.asc | sudo apt-key add -
echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/4.4 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.4.list
sudo apt-get update
sudo apt-get install -y mongodb-org
sudo systemctl start mongod
sudo systemctl daemon-reload
sudo systemctl enable mongod

Update haproxy

nano /etc/haproxy/haproxy.cfg

Paste this under all:

frontend wwwhttp
        bind 0.0.0.0:80
        option forwardfor except 127.0.0.0/8
        http-request add-header X-Forwarded-Proto http

        acl letsencrypt-acl path_beg /.well-known/acme-challenge/
        use_backend letsencrypt-backend if letsencrypt-acl
        default_backend letsencrypt-backend

backend letsencrypt-backend
        server letsencrypt 127.0.0.1:8787

Reload haproxy

sudo service haproxy reload

Update crontab

sudo nano /etc/cron.d/certbot

Comment all other lines and paste this:

0 0 1 * * root bash /opt/update-certs.sh

Clone and run FDM

git clone https://github.com/runonflux/flux-domain-manager
cd flux-domain-manager/
npm i
screen -S FDM
npm start

---

Final words

FDM is updating /opt/update-certs.sh file automatically with following content

#!/usr/bin/env bash

# Renew the certificate
certbot renew --force-renewal --http-01-port=8787 --preferred-challenges http

# Concatenate new cert files, with less output (avoiding the use tee and its output to stdout)
bash -c "cat /etc/letsencrypt/live/rosetta.runonflux.io/fullchain.pem /etc/letsencrypt/live/rosetta.runonflux.io/privkey.pem > /etc/ssl/rosetta.runonflux.io/rosetta.runonflux.io.pem"

# Reload  HAProxy
service haproxy reload