update

.env.example

@@ -1,6 +1,6 @@
-TAPM_LISTEN_ADDR=:8080
+TAPM_LISTEN_ADDR=127.0.0.1:8080
 TAPM_PUBLIC_URL=https://tapm.scity.us
-TAPM_DATABASE_DSN=tapm:change-me@tcp(galera.example.internal:3306)/tapm_broker?parseTime=true&charset=utf8mb4&collation=utf8mb4_unicode_ci&multiStatements=true&time_zone=%27%2B00%3A00%27
+TAPM_DATABASE_DSN=tapm:change-me@tcp(127.0.0.1:3306)/tapm_broker?parseTime=true&charset=utf8mb4&collation=utf8mb4_unicode_ci&multiStatements=true&time_zone=%27%2B00%3A00%27
 TAPM_GITEA_URL=https://git.scity.us
 TAPM_GITEA_CLIENT_ID=replace-me
 TAPM_GITEA_CLIENT_SECRET=replace-me

compose.yaml

@@ -4,12 +4,14 @@ services:
     image: tai/tapm-deployment-broker:local
     entrypoint: ["/usr/local/bin/tapm-migrate"]
     env_file: .env
+    network_mode: host
     restart: "no"
 
   broker:
     build: .
     image: tai/tapm-deployment-broker:local
     env_file: .env
+    network_mode: host
     restart: unless-stopped
     init: true
     read_only: true
@@ -19,8 +21,6 @@ services:
       - ALL
     tmpfs:
       - /tmp:size=16m,mode=1777
-    ports:
-      - "127.0.0.1:8080:8080"
     healthcheck:
       test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8080/health/ready"]
       interval: 30s

docs/deployment.md

@@ -2,7 +2,9 @@
 
 This service is intended to run on both webserver VMs, with only the active
 webserver's broker container started. Both installations use the same MariaDB
-Galera database, Gitea application, package registry, and secrets.
+Galera database, Gitea application, package registry, and secrets. The
+containers use Linux host networking so `127.0.0.1:3306` reaches each
+webserver's local HAProxy listener.
 
 ## 1. DNS and TLS
 
@@ -16,21 +18,27 @@ Adjust only the certificate paths if the local convention differs.
 
 ## 2. MariaDB Galera
 
-Create a dedicated database and least-privilege application user. Run this once
-against the cluster as a database administrator:
+Create a dedicated database and application users limited to the two webserver
+addresses. Run this once against the cluster as a database administrator,
+replacing the password with the same locally generated value in both accounts:
 
 ```sql
 CREATE DATABASE tapm_broker
     CHARACTER SET utf8mb4
     COLLATE utf8mb4_unicode_ci;
-CREATE USER 'tapm'@'10.%' IDENTIFIED BY 'replace-with-a-random-password';
+CREATE USER 'tapm'@'10.10.1.121' IDENTIFIED BY 'replace-with-a-random-password';
+CREATE USER 'tapm'@'10.10.1.122' IDENTIFIED BY 'replace-with-a-random-password';
 GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, REFERENCES
-    ON tapm_broker.* TO 'tapm'@'10.%';
+    ON tapm_broker.* TO 'tapm'@'10.10.1.121';
+GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, REFERENCES
+    ON tapm_broker.* TO 'tapm'@'10.10.1.122';
 FLUSH PRIVILEGES;
 ```
 
-Restrict the host pattern further if the two webserver addresses are known.
-The application does not need global privileges.
+The Keepalived address `10.10.1.120` is not included because outbound HAProxy
+connections normally originate from the physical webserver address. Add a
+third account for `10.10.1.120` only if a connection test or the HAProxy
+configuration proves that it explicitly uses the virtual address as its source.
 
 ## 3. Gitea accounts and OAuth
 
@@ -66,9 +74,9 @@ openssl rand -base64 48
 ```
 
 The database DSN must retain `parseTime=true`, `multiStatements=true`, and the
-encoded UTC `time_zone` setting from `.env.example`.
-Set the Galera address to an existing database VIP or load-balanced endpoint,
-not a single cluster member.
+encoded UTC `time_zone` setting from `.env.example`. Its address remains
+`127.0.0.1:3306`, which uses the local HAProxy frontend rather than selecting a
+single Galera member.
 
 ## 5. Build and migrate