dns-proxy-box.git · agent.md

revision b0a36d25df6497f6b349efb5688860fde07e2cf9 · complete file
# Codex Agent: dns-proxy-box

## 🎯 Purpose

This agent provisions a small **three node cluster** for the FountainAI system.
The centerpiece is a hardened Caddy reverse proxy that routes all `*.fountain.coach` traffic and manages DNS via AWS Route53. The repository also documents and automates the Typesense search node and the Swift services box through an interactive Python script. It exposes a diagnostics API described in the OpenAPI 3.1 file [openapi/provisioning-api.yaml](openapi/provisioning-api.yaml).


## 🧠 Responsibilities

- Configure a production-ready Hetzner reverse proxy
- Document and automate the Typesense and Swift service nodes
- Use Caddy for automatic HTTPS via Let's Encrypt (HTTP-01)
- Enable manual AWS CLI DNS management (no automation)
- Maintain the interactive Python setup script and its tests
- Harden the system for secure operation in public environments

## 🔐 Security Principles

- Uses a dedicated `fountainproxy` Linux user
- Only exposes ports `80`, `443`, and `22`
- No password SSH — key-only access recommended
- DNS credentials stored in `~/.aws/credentials`, never in code

## 🧰 Tools Used

- Python 3 and pytest
- Caddy (installed via official apt repo)
- AWS CLI v2
- hcloud CLI
- Docker Compose
- UFW for firewall
- Systemd-managed services (optional)
- Environment variable management via the diagnostics API

## 🗺️ Codex Role

This repo is classified under:

```toml
[agent]
role = "infrastructure"
type = "codex-agent"
language = "python"
```

It may be used to:

- Verify deployment readiness
- Generate Caddyfile diffs
- Plan Hetzner-based upgrades
- Run the Python provisioning script