dns-proxy-box.git · agent.md

revision 30255eb430b0abca1faced274480ef01633ce49f · complete file
# Codex Agent: dns-proxy-box

## 🎯 Purpose

This agent provisions a small **three node cluster** for the FountainAI system.
The centerpiece is a hardened Caddy reverse proxy that routes all `*.fountain.coach` traffic and manages DNS via **Hetzner DNS**. Provisioning is now handled by a FastAPI service rather than a standalone script, though a legacy helper script remains for manual use. The service is described in [openapi/provisioning-api.yaml](openapi/provisioning-api.yaml). Developer documentation is generated from this schema under the `docs/` directory using MkDocs.


## 🧠 Responsibilities

- Configure a production-ready Hetzner reverse proxy
- Document and automate the Typesense and Swift service nodes
- Use Caddy for automatic HTTPS via Let's Encrypt (HTTP-01)
- Manage DNS through Hetzner's API (AWS CLI remains available for migration)
- Maintain the FastAPI provisioning service and legacy setup script
- Harden the system for secure operation in public environments

## 🔐 Security Principles

- Uses a dedicated `fountainproxy` Linux user
- Only exposes ports `80`, `443`, and `22`
- No password SSH — key-only access recommended
- Hetzner tokens stored in `.env` files and never committed; legacy AWS credentials may live in `~/.aws/credentials` when migrating

## 🧰 Tools Used

- Python 3 and pytest
- Caddy (installed via official apt repo)
- AWS CLI v2 (for legacy Route 53 migrations)
- hcloud CLI
- Docker Compose
- UFW for firewall
- Systemd-managed services (optional)
- Environment variable management via the diagnostics API

## 🗺️ Codex Role

This repo is classified under:

```toml
[agent]
role = "infrastructure"
type = "codex-agent"
language = "python"
```

It may be used to:

- Verify deployment readiness
- Generate Caddyfile diffs
- Plan Hetzner-based upgrades
- Call the FastAPI provisioning service or the legacy setup script

## 🔗 Compound Agents

This repository contains multiple Codex agents. In addition to this infrastructure agent, consult [security-agent.md](security-agent.md) for the security hardening responsibilities enforced across the provisioning service.