Linux-Servers.md: Added Apache reverse proxy forwarding to another host

Linux-Servers.md

@@ -108,3 +108,199 @@ Change the SSL certificate setup so that future renewals will work.
 If not already done by completing the task before, repair the SSL connection so that "kipurchat.creature-go.com" can be used again.
 
 
+---
+
+# Podman shell script for AFFiNE service
+
+## Motivation
+
+A Podman Pod is needed on a Linux server which provides an AFFiNE service.
+This Podman Pod needs to be created and started with a shell script which needs to be designed.
+
+The AFFiNE service will be used by humans and by AI agents; it will also be part of a design environment for designing a special MCP server for AFFiNE.
+
+## Shell script requirements
+
+Requirements for the shell script:
+- Must use a container image with a Pinned Tag (for exact consistency) which points to the AFFiNE version 0.26.3. The name likely is something like "ghcr.io/toeverything/affine:0.26.3".
+- Must provide the AFFiNE web user interface at port 8092.
+- Must provide the GraphQL API. Background: The AFFiNE web and desktop apps use an internal GraphQL API to communicate with the backend. There is a /graphql endpoint but it is not documented for third-party use.
+- Must be in folder /home/pln/bin.
+- Must have the name create_pod_affine.sh
+
+The shell script shall be run by user pln which has permissions to run rootless pods.
+
+## Shell script style
+
+The needed shell script must have the same style as other shell scripts on the server.
+
+These files are examples:
+/home/lwc/bin/create_pod_langflow.sh
+/home/krt/bin/create_pod_qdrant.sh
+
+## Your tasks
+
+### Ask first
+
+Before starting to design the shell script, ask between two and five questions to fully understand the situation, your tasks and the objectives.
+
+### Identify the container image
+
+Find the container image with Pinned Tag pointing to AFFiNE version 0.26.3.
+
+### Write the shell script
+
+Write the shell script.
+
+### Test the shell script
+
+Run the shell script and test it.
+
+### Redesign if necessary
+
+If the test failed, understand the problem, improve the shell script and go back to Test the shell script.
+
+Repeat this in a loop up to five times.
+
+## Your objectives
+
+Your objectives are:
+- All requirements are fulfilled.
+- AFFiNE web user interface shows up at 127.0.0.1:8092.
+- The AFFiNE GraphQL API shows up under 127.0.0.1:8092 at /graphql or another link.
+
+## Your behaviour
+
+If it is not possible to achieve your objectives, interrupt and ask me.
+
+Complete all your tasks without asking in between if you can achieve your objectives.
+
+---
+
+# New Traefik route
+
+## Motivation
+
+A new service runs on the server and needs to be provided to the internet by installing a new Traefik route.
+
+## Traefik service
+
+Traefik runs as a systemd service in a Podman Pod.
+To end the service and Pod, run `/home/trf/bin/remove_pod_systemd_services.sh`.
+To start the Pod and the service, run `create_pod_traefik.sh`.
+
+## Traefik configuration
+
+The Traefik configuration directory is `/home/trf/.local/share/traefik/`.
+
+The main configuration file is `/home/trf/.local/share/traefik/traefik.yml`.
+In the directory `/home/trf/.local/share/traefik/dynamic` are the .yml files for the individual routings.
+
+## New service
+
+The new service for which the new Traefik route is needed:
+- Name is "affine"
+- Provided at 127.0.0.1:8092
+
+## Your tasks
+
+Your tasks are:
+- Ask questions if necessary to understand the situation and the tasks below.
+- Create the necessary file in `/home/trf/.local/share/traefik/dynamic`.
+- Update `/home/trf/.local/share/traefik/traefik.yml`. 
+
+
+---
+
+# Apache reverse proxy forwarding to another host
+
+## Setup
+
+The setup comprises two servers which are connected via WireGuard.
+
+### Linux server sv005.destengs.com
+
+- In a data center
+- Managed using Virtualmin
+- Two Virtual Servers:
+    - kipurchat.creature-go.com
+    - affine.creature-go.com
+- Uses Apache reverse proxy
+- WireGuard IP address 10.8.0.1
+
+### Linux server DesTEngSsv006
+
+- Local server
+- Uses Traefik to route ingest traffic to microservices
+- WireGuard IP address 10.8.0.6
+- Provides the AFFiNE microservice
+    - Internal at 127.0.0.1:8092
+
+## Previous problems
+
+In the past I often faced problems with the Apache directives.
+
+### SSL certificate renewal failed
+
+The Virtual Server kipurchat.creature-go.com was set up using Virtualmin some monthes ago. Then a forward was installed which routed the traffic of kipurchat.creature-go.com from sv005.destengs.com to DesTEngSsv006. When the automated SSL certificate renewal was triggered the renewal failed. The Apache directives file needed to be fixed so that the ACME check could succeed.
+
+## Assistance for affine.creature-go.com forwarding
+
+I just created the Virtual Server affine.creature-go.com . https://affine.creature-go.com/ works, has a valid SSL certificate and shows the expected Virtualmin Welcome-Page.
+
+I would like to have your assistance to set up the forwarding for affine.creature-go.com to get a bullet-proof Apache directives file which also will allow the SSL certificate renewal in some weeks.
+
+## Your tasks
+
+### Interview
+
+Interview me to
+- Fully understand the situation
+- Clarify the objective
+- Obtain all files you need
+
+### Update DesTEngSsv006 configuration
+
+Help me to update the DesTEngSsv006 configuration so that affine.creature-go.com forwarding works as expected and SSL certificate renewal will succeed.
+
+
+
+
+1. The Apache VHost Config: Could you share the current contents of the Apache configuration file for affine.creature-go.com on sv005? (Usually found in /etc/apache2/sites-available/ or managed via Virtualmin's "Edit Directives" section).
+
+2. Traefik's Entrypoint: On DesTEngSsv006, is Traefik listening for incoming traffic on port 80/443 over the WireGuard interface (10.8.0.6)?
+
+3. Traefik Configuration: Have you already set up a router and service in Traefik for affine.creature-go.com? If so, could you share that snippet (labels in Docker or your YAML/TOML config)?
+
+4. SSL Strategy: Is sv005 the only place where you want SSL to be terminated, or are you also trying to use Let's Encrypt on the Traefik side? (Standard practice here is to terminate at sv005 and send plain HTTP or "pseudo-HTTPS" over the tunnel).
+
+
+## Interview answers
+
+1. Attached is affine.creature-go.com.conf
+
+2. Traefik is listening on 10.8.0.6:8080
+
+3. Attached is the main Traefik config file traefik.yml from the DesTEngSsv006 directory /home/trf/.local/share/traefik and the three .yml config files {affine.yml, dashboard.yml, openwebui.yml} from the DesTEngSsv006 directory /home/trf/.local/share/traefik/dynamic/
+
+4. Terminate SSL at sv005 and send plain HTTP over the tunnel
+
+
+
+What about the already existing RewriteCond lines in the Apache config file?
+I would appreciate if you would update the complete affine.creature-go.com.conf file instead of giving me snippets which I have to insert at the hopefully correct position.
+
+
+Questions about both sections <VirtualHost ...:80> and <VirtualHost ...:443>:
+- You did remove <Directory /home/affine/cgi-bin> but you did leave
+  <Directory /home/affine/public_html> in - why didn't you take out both
+  directories because they are not used? Any objections if I would remove the <Directory /home/affine/public_html>?
+- There is no mail support at affine.creature-go.com so I plan to remove
+  RewriteCond and RewriteRule for Webmail - any objections?
+
+Questions about <VirtualHost ...:443> section:
+- Why did you relocate the SSL Configuration block?
+
+
+---
+