feat: vanity domains

nix/treefmt.nix

@@ -64,5 +64,6 @@
   settings.global.excludes = [
     "*/gen/*"
     "docs/*"
+    "*/generated.*"
   ];
 }

packages/oyasai-cdktf/src/stacks/common-infra.ts

@@ -82,8 +82,7 @@ export class CommonInfra extends OyasaiTerraformStack {
 
     const secrets = createSecrets(this, this);
 
-    // TODO: Data because Cloudflare doesn't support importing registrar domain
-    // - shun 2026-04
+    // "Data" because Cloudflare doesn't support importing this resource
     this.oyasaiIoRegistrarDomain = new DataCloudflareRegistrarDomain(
       this,
       this.t("oyasai-io-registrar-domain"),

packages/oyasai-cdktf/src/stacks/platform-infra.ts

@@ -15,6 +15,7 @@ export class PlatformInfra extends OyasaiPlatformTerraformStack {
   public readonly ipv4 = "121.81.157.109";
 
   public readonly r2Bucket: R2Bucket;
+  public readonly rootDnsRecord: DnsRecord;
 
   public constructor(
     scope: Construct,
@@ -41,19 +42,26 @@ export class PlatformInfra extends OyasaiPlatformTerraformStack {
       location: this.isMaster ? "apac" : "enam",
     });
 
+    this.rootDnsRecord = new DnsRecord(this, this.t("root-dns-record"), {
+      ttl: 1, // automatic
+      zoneId: oyasaiIoZone.id,
+      name: `${this.environment}.${oyasaiIoRegistrarDomain.domainName}`,
+      type: "A",
+      proxied: false,
+      content: this.isMaster ? this.ipv4 : "0.0.0.0",
+    });
+
+    // Vanity domains
     if (this.isMaster) {
-      // We _can_ make dns record for every environment, though it's currently
-      // unnecessary. - shun 2026-04
-      new DnsRecord(this, this.t("root-dns-record"), {
+      new DnsRecord(this, "root-vanity-dns-record", {
         ttl: 1, // automatic
         zoneId: oyasaiIoZone.id,
         name: oyasaiIoRegistrarDomain.domainName,
         type: "A",
         proxied: false,
-        content: this.ipv4,
+        content: this.rootDnsRecord.content,
       });
 
-      // Proxy to our seesaawiki. Implicitly reserves `wiki.oyasai.io`.
       new DnsRecord(this, "seesaawiki-cname-dns-record", {
         ttl: 1, // automatic
         zoneId: oyasaiIoZone.id,

packages/oyasai-cdktf/src/stacks/platform-services.ts

@@ -56,6 +56,7 @@ export class PlatformServices extends OyasaiPlatformTerraformStack {
       minecraftLobby: imageIds["oyasai-minecraft-lobby"],
       minecraftMain: imageIds["oyasai-minecraft-main"],
       mysqlBackup: imageIds["mysql-backup"],
+      traefik: imageIds["traefik"],
       velocity: imageIds["oyasai-velocity"],
       // keep-sorted end
     } as const;
@@ -67,6 +68,7 @@ export class PlatformServices extends OyasaiPlatformTerraformStack {
       minecraftAxiom: join(baseHostPath, "minecraft-axiom"),
       minecraftLobby: join(baseHostPath, "minecraft-lobby"),
       minecraftMain: join(baseHostPath, "minecraft-main"),
+      traefik: join(baseHostPath, "traefik"),
       velocity: join(baseHostPath, "velocity"),
       // keep-sorted end
     } as const;
@@ -134,6 +136,25 @@ export class PlatformServices extends OyasaiPlatformTerraformStack {
             hostPath: hostPaths.minecraftMain,
           },
         ],
+        labels: [
+          { label: "traefik.enable", value: "true" },
+          {
+            label: "traefik.http.routers.bluemap.rule",
+            value: `Host(\`bluemap.${platformInfra.rootDnsRecord.name}\`)`,
+          },
+          {
+            label: "traefik.http.routers.bluemap.entrypoints",
+            value: "websecure",
+          },
+          {
+            label: "traefik.http.routers.bluemap.tls.certresolver",
+            value: "myresolver",
+          },
+          {
+            label: "traefik.http.services.bluemap.loadbalancer.server.port",
+            value: "8100",
+          },
+        ],
         ...(this.isMaster && {
           // Pin container to P-cores only (logical CPUs 0–11) to avoid latency
           // spikes caused by the main tick thread being scheduled on E-cores.
@@ -289,6 +310,61 @@ export class PlatformServices extends OyasaiPlatformTerraformStack {
           DB_DEBUG: true,
         }),
       });
+
+      new Container(this, this.t("traefik-container"), {
+        image: images.traefik,
+        name: "traefik",
+        restart: "unless-stopped",
+        networksAdvanced: [network],
+        ports: ports({
+          tcp: [80, 443],
+        }),
+        command: [
+          "--providers.docker=true",
+          "--providers.docker.exposedbydefault=false",
+          "--entrypoints.web.address=:80",
+          "--entrypoints.websecure.address=:443",
+          "--entrypoints.web.http.redirections.entrypoint.to=websecure",
+          "--entrypoints.web.http.redirections.entrypoint.scheme=https",
+          "--certificatesresolvers.myresolver.acme.tlschallenge=true",
+        ],
+        volumes: [
+          {
+            hostPath: "/var/run/docker.sock",
+            containerPath: "/var/run/docker.sock",
+          },
+          {
+            hostPath: hostPaths.traefik,
+            containerPath: "/etc/traefik/acme",
+          },
+        ],
+      });
+
+      new Container(this, this.t("hello-world-container"), {
+        image: "containous/whoami:latest",
+        name: "hello-world-web",
+        restart: "unless-stopped",
+        networksAdvanced: [network],
+        labels: [
+          { label: "traefik.enable", value: "true" },
+          {
+            label: "traefik.http.routers.helloworld.rule",
+            value: `Host(\`${platformInfra.rootDnsRecord.name}\`)`,
+          },
+          {
+            label: "traefik.http.routers.helloworld.entrypoints",
+            value: "websecure",
+          },
+          {
+            label: "traefik.http.routers.helloworld.tls.certresolver",
+            value: "myresolver",
+          },
+          {
+            label: "traefik.http.services.helloworld.loadbalancer.server.port",
+            value: "80",
+          },
+        ],
+      });
     }
   }
 }

packages/oyasai-standalone-images/nvfetcher.toml

@@ -15,3 +15,9 @@ docker.os = "linux"
 docker.arch = "amd64"
 fetch.docker = "databack/mysql-backup"
 src.manual = "1.4.0"
+
+[traefik]
+docker.os = "linux"
+docker.arch = "amd64"
+fetch.docker = "traefik"
+src.manual = "3.7.4"

packages/oyasai-standalone-images/package.nix

@@ -5,11 +5,19 @@
 }:
 
 let
-  inherit (callPackage ./_sources/generated.nix { }) mariadb mc-backup mysql-backup;
+  inherit (callPackage ./_sources/generated.nix { })
+    # keep-sorted start
+    mariadb
+    mc-backup
+    mysql-backup
+    traefik
+    # keep-sorted end
+    ;
 in
 runCommandLocal "oyasai-standalone-images"
   {
     passthru = {
+      # keep-sorted start block=yes
       mariadb = oyasaiDockerTools.buildImage {
         name = mariadb.pname;
         fromImage = mariadb.src;
@@ -33,6 +41,15 @@ runCommandLocal "oyasai-standalone-images"
           Entrypoint = [ "/entrypoint" ];
         };
       };
+      traefik = oyasaiDockerTools.buildImage {
+        name = traefik.pname;
+        fromImage = traefik.src;
+        config = {
+          Entrypoint = [ "/entrypoint.sh" ];
+          Cmd = [ "traefik" ];
+        };
+      };
+      # keep-sorted end
     };
   }
   ''