From b0c83ca98586e23aa887dc1fbab70fe64c9967e1 Mon Sep 17 00:00:00 2001 From: david Date: Tue, 11 Aug 2026 14:53:07 +0200 Subject: [PATCH] =?UTF-8?q?docs(deploy):=20correct=20DNS=20guidance=20for?= =?UTF-8?q?=20Hetzner=20suppliers=20=E2=80=94=20no=20wildcard=20exists?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PR #12 runbook and compose pre-flight headers claimed a wildcard *.vector.apexfusion.org record covers new supplier hosts. It does not: each mp-suppliers-* host is an individual DNS-only A record to 91.98.147.172, and on-box Let's Encrypt HTTP-01 issuance requires the record to be unproxied. Co-Authored-By: Claude Fable 5 --- .../docker-compose.supplier-ds-flash-htz-chat.yml | 3 ++- deploy/mainnet/docker-compose.supplier-ds-flash-htz.yml | 3 ++- deploy/mainnet/docker-compose.supplier-glm-chat.yml | 3 ++- deploy/mainnet/docker-compose.supplier-glm.yml | 3 ++- .../mainnet/docker-compose.supplier-kimi-code-chat.yml | 3 ++- deploy/mainnet/docker-compose.supplier-kimi-code.yml | 3 ++- deploy/mainnet/docker-compose.supplier-qwen35b-chat.yml | 3 ++- deploy/mainnet/docker-compose.supplier-qwen35b.yml | 3 ++- docs/HETZNER_SETUP.md | 9 +++++++-- 9 files changed, 23 insertions(+), 10 deletions(-) diff --git a/deploy/mainnet/docker-compose.supplier-ds-flash-htz-chat.yml b/deploy/mainnet/docker-compose.supplier-ds-flash-htz-chat.yml index 1836ad7..d967bc4 100644 --- a/deploy/mainnet/docker-compose.supplier-ds-flash-htz-chat.yml +++ b/deploy/mainnet/docker-compose.supplier-ds-flash-htz-chat.yml @@ -15,7 +15,8 @@ # # Pre-flight: # 1. DNS: mp-suppliers-ds-flash-htz-chat.vector.apexfusion.org → host -# (wildcard *.vector.apexfusion.org already in place via Cloudflare) +# (individual DNS-only A record → 91.98.147.172; NO wildcard exists — +# letsencrypt HTTP-01 issuance needs the unproxied direct record) # 2. supplier/.env.ds-flash-htz-chat written on host (chmod 600) with at minimum: # SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH, # SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, diff --git a/deploy/mainnet/docker-compose.supplier-ds-flash-htz.yml b/deploy/mainnet/docker-compose.supplier-ds-flash-htz.yml index f90fd08..512fd1a 100644 --- a/deploy/mainnet/docker-compose.supplier-ds-flash-htz.yml +++ b/deploy/mainnet/docker-compose.supplier-ds-flash-htz.yml @@ -10,7 +10,8 @@ # # Pre-flight: # 1. DNS: mp-suppliers-ds-flash-htz.vector.apexfusion.org → host -# (wildcard *.vector.apexfusion.org already in place via Cloudflare) +# (individual DNS-only A record → 91.98.147.172; NO wildcard exists — +# letsencrypt HTTP-01 issuance needs the unproxied direct record) # 2. supplier/.env.ds-flash-htz written on host (chmod 600) with at minimum: # SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH, # SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, diff --git a/deploy/mainnet/docker-compose.supplier-glm-chat.yml b/deploy/mainnet/docker-compose.supplier-glm-chat.yml index 7a94e1e..2112000 100644 --- a/deploy/mainnet/docker-compose.supplier-glm-chat.yml +++ b/deploy/mainnet/docker-compose.supplier-glm-chat.yml @@ -15,7 +15,8 @@ # # Pre-flight: # 1. DNS: mp-suppliers-glm-chat.vector.apexfusion.org → host -# (wildcard *.vector.apexfusion.org already in place via Cloudflare) +# (individual DNS-only A record → 91.98.147.172; NO wildcard exists — +# letsencrypt HTTP-01 issuance needs the unproxied direct record) # 2. supplier/.env.glm-chat written on host (chmod 600) with at minimum: # SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH, # SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, diff --git a/deploy/mainnet/docker-compose.supplier-glm.yml b/deploy/mainnet/docker-compose.supplier-glm.yml index aa2d5f3..4a846cb 100644 --- a/deploy/mainnet/docker-compose.supplier-glm.yml +++ b/deploy/mainnet/docker-compose.supplier-glm.yml @@ -10,7 +10,8 @@ # # Pre-flight: # 1. DNS: mp-suppliers-glm.vector.apexfusion.org → host -# (wildcard *.vector.apexfusion.org already in place via Cloudflare) +# (individual DNS-only A record → 91.98.147.172; NO wildcard exists — +# letsencrypt HTTP-01 issuance needs the unproxied direct record) # 2. supplier/.env.glm written on host (chmod 600) with at minimum: # SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH, # SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, diff --git a/deploy/mainnet/docker-compose.supplier-kimi-code-chat.yml b/deploy/mainnet/docker-compose.supplier-kimi-code-chat.yml index a6a268d..040e7c3 100644 --- a/deploy/mainnet/docker-compose.supplier-kimi-code-chat.yml +++ b/deploy/mainnet/docker-compose.supplier-kimi-code-chat.yml @@ -15,7 +15,8 @@ # # Pre-flight: # 1. DNS: mp-suppliers-kimi-code-chat.vector.apexfusion.org → host -# (wildcard *.vector.apexfusion.org already in place via Cloudflare) +# (individual DNS-only A record → 91.98.147.172; NO wildcard exists — +# letsencrypt HTTP-01 issuance needs the unproxied direct record) # 2. supplier/.env.kimi-code-chat written on host (chmod 600) with at minimum: # SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH, # SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, diff --git a/deploy/mainnet/docker-compose.supplier-kimi-code.yml b/deploy/mainnet/docker-compose.supplier-kimi-code.yml index 4228e4b..9cc0327 100644 --- a/deploy/mainnet/docker-compose.supplier-kimi-code.yml +++ b/deploy/mainnet/docker-compose.supplier-kimi-code.yml @@ -10,7 +10,8 @@ # # Pre-flight: # 1. DNS: mp-suppliers-kimi-code.vector.apexfusion.org → host -# (wildcard *.vector.apexfusion.org already in place via Cloudflare) +# (individual DNS-only A record → 91.98.147.172; NO wildcard exists — +# letsencrypt HTTP-01 issuance needs the unproxied direct record) # 2. supplier/.env.kimi-code written on host (chmod 600) with at minimum: # SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH, # SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, diff --git a/deploy/mainnet/docker-compose.supplier-qwen35b-chat.yml b/deploy/mainnet/docker-compose.supplier-qwen35b-chat.yml index c8ea8b8..e7390e4 100644 --- a/deploy/mainnet/docker-compose.supplier-qwen35b-chat.yml +++ b/deploy/mainnet/docker-compose.supplier-qwen35b-chat.yml @@ -15,7 +15,8 @@ # # Pre-flight: # 1. DNS: mp-suppliers-qwen35b-chat.vector.apexfusion.org → host -# (wildcard *.vector.apexfusion.org already in place via Cloudflare) +# (individual DNS-only A record → 91.98.147.172; NO wildcard exists — +# letsencrypt HTTP-01 issuance needs the unproxied direct record) # 2. supplier/.env.qwen35b-chat written on host (chmod 600) with at minimum: # SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH, # SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, diff --git a/deploy/mainnet/docker-compose.supplier-qwen35b.yml b/deploy/mainnet/docker-compose.supplier-qwen35b.yml index fa67c81..2ae33de 100644 --- a/deploy/mainnet/docker-compose.supplier-qwen35b.yml +++ b/deploy/mainnet/docker-compose.supplier-qwen35b.yml @@ -10,7 +10,8 @@ # # Pre-flight: # 1. DNS: mp-suppliers-qwen35b.vector.apexfusion.org → host -# (wildcard *.vector.apexfusion.org already in place via Cloudflare) +# (individual DNS-only A record → 91.98.147.172; NO wildcard exists — +# letsencrypt HTTP-01 issuance needs the unproxied direct record) # 2. supplier/.env.qwen35b written on host (chmod 600) with at minimum: # SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH, # SUPPLIER_PUB_KEY_HEX, OPENAI_API_KEY, OGMIOS_URL, NETWORK_ID=1, diff --git a/docs/HETZNER_SETUP.md b/docs/HETZNER_SETUP.md index 2a77265..97373a9 100644 --- a/docs/HETZNER_SETUP.md +++ b/docs/HETZNER_SETUP.md @@ -48,8 +48,13 @@ fleet serving `deepseek/deepseek-v4-flash`. rate limits apply to the aggregate. 2. Eight funded supplier wallets (50 AP3X each recommended; bonds are 1 AP3X per in-flight job and returned on completion). -3. The usual mainnet supplier deploy prerequisites (`deploy/README.md`); the - wildcard DNS `*.vector.apexfusion.org` already covers the new hosts. +3. The usual mainnet supplier deploy prerequisites (`deploy/README.md`). +4. **DNS**: one A record per supplier — `mp-suppliers-.vector.apexfusion.org` + → `91.98.147.172`, **DNS-only/unproxied**. There is NO wildcard for + `*.vector.apexfusion.org`; and because traefik issues certs on-box via + Let's Encrypt HTTP-01 (port 80), a proxied/CDN record would break issuance. + Certs are issued automatically within ~a minute of the record propagating — + no restarts needed. ## 3. Verify the backend before spending on-chain