docs(ingress): record cnnetmkt SSL ingress status

deploy/nginx/g-cnnetmkt-gitea-server.conf

@@ -0,0 +1,52 @@
+# AIOS GitOps alias for https://g.cnnetmkt.top/
+# Note: this server block intentionally keeps /git/ as the Gitea app prefix,
+# matching the current Gitea ROOT_URL and avoiding a disruptive app.ini rewrite.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name g.cnnetmkt.top;
+
+    access_log /var/log/nginx/aios-g-cnnetmkt.access.log;
+    error_log /var/log/nginx/aios-g-cnnetmkt.error.log;
+
+    ssl_certificate /etc/letsencrypt/live/user.cnnetmkt.top/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/user.cnnetmkt.top/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location = / {
+        return 302 /git/;
+    }
+
+    location = /git {
+        return 302 /git/;
+    }
+
+    location /git/ {
+        proxy_pass http://127.0.0.1:3000/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Prefix /git;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_redirect off;
+    }
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name g.cnnetmkt.top;
+
+    location = / {
+        return 302 https://$host/git/;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}

docs/ops/CNNETMKT_SSL_INGRESS_STATUS.md

@@ -0,0 +1,83 @@
+# cnnetmkt SSL ingress status
+
+generated_at=2026-07-06T15:48:12+08:00
+g_route_status=installed
+certbot_status=issued-g-user-portal
+apex_dns_status=blocked_until_cnnetmkt.top_has_A_record_to_1.95.164.183
+wildcard_status=blocked_until_dns01_provider_credentials_available
+backup_dir=/data/aios-gitops/backups/nginx-g-cnnetmkt-20260706-154743
+tracked_nginx=/data/aios-gitops/workspace/deploy/nginx/g-cnnetmkt-gitea-server.conf
+
+## validation
+### g.cnnetmkt.top
+HTTP/1.1 302 Moved Temporarily
+Server: nginx/1.24.0 (Ubuntu)
+Date: Mon, 06 Jul 2026 07:48:12 GMT
+Content-Type: text/html
+Content-Length: 154
+Location: https://g.cnnetmkt.top/git/
+Connection: keep-alive
+
+<title>302 Found
+
+subject=CN = user.cnnetmkt.top
+issuer=C = US, O = Let's Encrypt, CN = YE2
+notBefore=Jul  6 06:49:39 2026 GMT
+notAfter=Oct  4 06:49:38 2026 GMT
+X509v3 Subject Alternative Name: 
+    DNS:g.cnnetmkt.top, DNS:portal.cnnetmkt.top, DNS:user.cnnetmkt.top
+
+### cnnetmkt.top
+HTTP/1.1 302 Found
+Server: nginx/1.24.0 (Ubuntu)
+Date: Mon, 06 Jul 2026 07:48:12 GMT
+Content-Type: text/html; charset=utf-8
+Content-Length: 0
+Connection: keep-alive
+Location: /portal/login/
+X-Request-ID: 7c649abe-a2de-4b3e-87fe-325f4297738f
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+Referrer-Policy: same-origin
+Cross-Origin-Opener-Policy: same-origin
+
+subject=CN = user.cnnetmkt.top
+issuer=C = US, O = Let's Encrypt, CN = YE2
+notBefore=Jul  6 06:49:39 2026 GMT
+notAfter=Oct  4 06:49:38 2026 GMT
+X509v3 Subject Alternative Name: 
+    DNS:g.cnnetmkt.top, DNS:portal.cnnetmkt.top, DNS:user.cnnetmkt.top
+
+### user.cnnetmkt.top
+HTTP/1.1 302 Found
+Server: nginx/1.24.0 (Ubuntu)
+Date: Mon, 06 Jul 2026 07:48:12 GMT
+Content-Type: text/html; charset=utf-8
+Content-Length: 0
+Connection: keep-alive
+Location: /portal/login/
+X-Request-ID: e3d70907-1ab7-456c-a725-7cb60647514d
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+Referrer-Policy: same-origin
+Cross-Origin-Opener-Policy: same-origin
+
+subject=CN = user.cnnetmkt.top
+issuer=C = US, O = Let's Encrypt, CN = YE2
+notBefore=Jul  6 06:49:39 2026 GMT
+notAfter=Oct  4 06:49:38 2026 GMT
+X509v3 Subject Alternative Name: 
+    DNS:g.cnnetmkt.top, DNS:portal.cnnetmkt.top, DNS:user.cnnetmkt.top
+
+## certbot
+
+- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+Found the following certs:
+  Certificate Name: user.cnnetmkt.top
+    Serial Number: 529feebc03b37f2866c25b1465f37e14565
+    Key Type: ECDSA
+    Domains: user.cnnetmkt.top g.cnnetmkt.top portal.cnnetmkt.top
+    Expiry Date: 2026-10-04 06:49:38+00:00 (VALID: 89 days)
+    Certificate Path: /etc/letsencrypt/live/user.cnnetmkt.top/fullchain.pem
+    Private Key Path: /etc/letsencrypt/live/user.cnnetmkt.top/privkey.pem
+- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

ops/gitops-migration/check_cnnetmkt_ingress.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "== host =="
+hostname
+date -Is
+
+echo "== /etc/hosts cnnetmkt =="
+grep -nE 'cnnetmkt|gitea|aios' /etc/hosts || true
+
+echo "== local resolver =="
+for n in cnnetmkt.top g.cnnetmkt.top user.cnnetmkt.top portal.cnnetmkt.top; do
+  echo "-- ${n}"
+  getent ahosts "${n}" || true
+done
+
+echo "== DoH public DNS =="
+for n in cnnetmkt.top g.cnnetmkt.top user.cnnetmkt.top portal.cnnetmkt.top; do
+  echo "-- ${n}"
+  curl -fsS --connect-timeout 10 --max-time 20 \
+    -H 'accept: application/dns-json' \
+    "https://cloudflare-dns.com/dns-query?name=${n}&type=A" || true
+  echo
+done
+
+echo "== local SNI HTTP/TLS =="
+for h in cnnetmkt.top g.cnnetmkt.top user.cnnetmkt.top portal.cnnetmkt.top; do
+  echo "-- ${h} curl /"
+  rm -f /tmp/aios-ingress-body
+  curl -k -sS -D - -o /tmp/aios-ingress-body \
+    --resolve "${h}:443:127.0.0.1" \
+    "https://${h}/" | sed -n '1,20p' || true
+  sed -n '1,16p' /tmp/aios-ingress-body 2>/dev/null || true
+  echo "-- ${h} curl /git/"
+  curl -k -sS -D - -o /tmp/aios-ingress-body \
+    --resolve "${h}:443:127.0.0.1" \
+    "https://${h}/git/" | sed -n '1,12p' || true
+  grep -ao '<title>[^<]*' /tmp/aios-ingress-body 2>/dev/null | head -1 || true
+  echo "-- ${h} cert"
+  echo | openssl s_client -connect 127.0.0.1:443 -servername "${h}" 2>/dev/null \
+    | openssl x509 -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null || true
+done
+
+echo "== certbot certificates =="
+sudo certbot certificates || true
+
+echo "== nginx matched config =="
+sudo nginx -T 2>/dev/null | grep -nE 'server_name|ssl_certificate|location = /git|location /git|proxy_pass http://127.0.0.1:3000' || true

ops/gitops-migration/fix_g_cnnetmkt_ingress.sh

@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="/data/aios-gitops"
+WORKSPACE="$ROOT/workspace"
+LOG="$ROOT/logs/g-cnnetmkt-ingress-fix.log"
+BACKUP_DIR="$ROOT/backups/nginx-g-cnnetmkt-$(date +%Y%m%d-%H%M%S)"
+SITE="/etc/nginx/sites-available/aios-user-portal.conf"
+TRACKED="$WORKSPACE/deploy/nginx/g-cnnetmkt-gitea-server.conf"
+REPORT="$ROOT/artifacts/CNNETMKT_SSL_INGRESS_STATUS.md"
+mkdir -p "$ROOT/logs" "$BACKUP_DIR" "$WORKSPACE/deploy/nginx" "$ROOT/artifacts"
+exec > >(tee -a "$LOG") 2>&1
+
+echo "== backup =="
+sudo cp -a "$SITE" "$BACKUP_DIR/aios-user-portal.conf"
+
+cat > "$TRACKED" <<'NGINX'
+# AIOS GitOps alias for https://g.cnnetmkt.top/
+# Note: this server block intentionally keeps /git/ as the Gitea app prefix,
+# matching the current Gitea ROOT_URL and avoiding a disruptive app.ini rewrite.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name g.cnnetmkt.top;
+
+    access_log /var/log/nginx/aios-g-cnnetmkt.access.log;
+    error_log /var/log/nginx/aios-g-cnnetmkt.error.log;
+
+    ssl_certificate /etc/letsencrypt/live/user.cnnetmkt.top/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/user.cnnetmkt.top/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location = / {
+        return 302 /git/;
+    }
+
+    location = /git {
+        return 302 /git/;
+    }
+
+    location /git/ {
+        proxy_pass http://127.0.0.1:3000/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Prefix /git;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_redirect off;
+    }
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name g.cnnetmkt.top;
+
+    location = / {
+        return 302 https://$host/git/;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+NGINX
+
+echo "== install g.cnnetmkt server block =="
+sudo cp "$TRACKED" /etc/nginx/sites-available/g-cnnetmkt-gitea.conf
+sudo ln -sfn /etc/nginx/sites-available/g-cnnetmkt-gitea.conf /etc/nginx/sites-enabled/g-cnnetmkt-gitea.conf
+sudo nginx -t
+sudo systemctl reload nginx
+
+echo "== local validation before cert expand =="
+for h in g.cnnetmkt.top cnnetmkt.top user.cnnetmkt.top; do
+  echo "-- $h /"
+  curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/" | sed -n '1,12p' || true
+  grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
+  echo "-- $h /git/"
+  curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/git/" | sed -n '1,12p' || true
+  grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
+done
+
+echo "== certbot dry run expand for g/user/portal =="
+CERTBOT_STATUS="not-run"
+if sudo certbot certonly --nginx --cert-name user.cnnetmkt.top \
+  -d user.cnnetmkt.top -d portal.cnnetmkt.top -d g.cnnetmkt.top \
+  --expand --dry-run --non-interactive --agree-tos; then
+  CERTBOT_STATUS="dry-run-ok"
+else
+  CERTBOT_STATUS="dry-run-failed"
+fi
+
+if [ "$CERTBOT_STATUS" = "dry-run-ok" ]; then
+  echo "== certbot real expand for g/user/portal =="
+  if sudo certbot certonly --nginx --cert-name user.cnnetmkt.top \
+    -d user.cnnetmkt.top -d portal.cnnetmkt.top -d g.cnnetmkt.top \
+    --expand --non-interactive --agree-tos; then
+    CERTBOT_STATUS="issued-g-user-portal"
+    sudo nginx -t
+    sudo systemctl reload nginx
+  else
+    CERTBOT_STATUS="real-issue-failed"
+  fi
+fi
+
+echo "== final cert and route validation =="
+{
+  echo "# cnnetmkt SSL ingress status"
+  echo
+  echo "generated_at=$(date -Is)"
+  echo "g_route_status=installed"
+  echo "certbot_status=$CERTBOT_STATUS"
+  echo "apex_dns_status=blocked_until_cnnetmkt.top_has_A_record_to_1.95.164.183"
+  echo "wildcard_status=blocked_until_dns01_provider_credentials_available"
+  echo "backup_dir=$BACKUP_DIR"
+  echo "tracked_nginx=$TRACKED"
+  echo
+  echo "## validation"
+  for h in g.cnnetmkt.top cnnetmkt.top user.cnnetmkt.top; do
+    echo "### $h"
+    curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/" | sed -n '1,12p' || true
+    grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
+    echo
+    echo | openssl s_client -connect 127.0.0.1:443 -servername "$h" 2>/dev/null \
+      | openssl x509 -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null || true
+    echo
+  done
+  echo "## certbot"
+  sudo certbot certificates || true
+} | tee "$REPORT"
+
+cd "$WORKSPACE"
+git add deploy/nginx/g-cnnetmkt-gitea-server.conf
+git commit -m "fix(ingress): add g.cnnetmkt.top GitOps alias" || true
+
+echo "G_CNNETMKT_INGRESS_FIX_DONE certbot_status=$CERTBOT_STATUS report=$REPORT"