| .. | ||
| gateway-admin.conf | ||
| gateway-nginx.conf | ||
| gateway-protect.conf | ||
| gateway.compose.yml | ||
| hn-gateway-cert.service | ||
| hn-gateway-cert.timer | ||
| hn-gateway-cloudflare-ips.service | ||
| hn-gateway-cloudflare-ips.timer | ||
| host.conf | ||
| install.py | ||
| migrate-t34.py | ||
| proxy.conf | ||
| README.md | ||
| renew-gateway.sh | ||
| update-cloudflare-ips.py | ||
HN independent subscription gateway
This deployment reuses the fixed, already-running DPL SubSieve images while keeping HN configuration, credentials, volumes, network, ports, certificates and upstream independent. It does not update or restart DPL/FUC containers.
Target: registered gateway-01 via the white SSH jump host. Public subscription host: t34.hardnerd-nodes.com. Upstream: https://hardnerd.net. Local management: https://127.0.0.1:26444 only; no public management virtual host is installed.
Publish the repository through Git before running the exact checked-out release. Run install.py prepare, then install.py certificate after public DNS/ACME readiness, then install.py start with an authorized administrator JSON object on stdin. Never place credentials in arguments or this repository. Each phase has state guards; inspect partial state before resuming rather than rerunning initialization.
Preflight checks free RAM/disk, fixed image IDs, all three loopback ports and the bridge subnet. Configuration uses ports 28080/28443/26444, hn_sgw_config / hn_sgw_logs, hn_sgw_net (172.28.32.0/24), and /var/lib/hn-sgw. Gateway/admin limits are 160MB/128MB and 0.5 CPU each. The state backup is /root/codex-backups/hn-gateway/20261027-first-install. Certificate files and registered account copy are isolated in /etc/hn-gateway-letsencrypt; no global renewal hooks run. Renewal reloads only the two HN containers and gracefully reloads host Nginx.
Public paths are limited to /s/{token} and /api/v1/client/subscribe. Host access logs are disabled; short paths become canonical API paths before entering the container, whose access log excludes query strings. TLS verification stays enabled both from host to container and from container to HN. Only Cloudflare ranges are trusted for CF-Connecting-IP; only the bridge gateway is trusted inside the container. The documented white host is allowlisted for server-side acceptance. Root and www hosts redirect to the HN main website.
Before changing HN's application subscription URL, verify a valid restricted QA token in supported client formats plus invalid/disabled tokens, no-store response headers, and the original-instance baseline. Empty HN node lists must be reported as empty; they do not constitute node connectivity acceptance. Cloudflare cache bypass is required for this dedicated subscription zone; preserve platform protections unless a specific compatibility change is authorized.
Rollback: restore the backed-up HN HTTP-only host file, nginx -t then graceful reload; stop only HN Compose services and HN timers, preserving HN volumes, credentials and backups for investigation. Do not run compose down on DPL/FUC or restart shared services. Current production evidence is maintained in docs/maintenance/HN_PRODUCTION.md and STATUS.md.
2026-10-28 endpoint migration: publish first, then run migrate-t34.py prepare, certificate, activate in sequence. The old c2 certificate is retained for rollback; the active certificate, SNI and isolated renewal service use t34. Retire old DNS only after new endpoint and application URL acceptance. Backup: /root/codex-backups/hn-gateway/20261028-t34.