Add Network and server infrastructure information

content/docs/(docs)/writing-documentation/dev-enviroment.mdx

@@ -4,8 +4,6 @@ icon: GitFork
 description: Getting the documentation ready for you
 ---
 
-import { Step, Steps } from "fumadocs-ui/components/steps";
-
 If you are new to Git and/or Github, welcome! This page should get you started.
 
 <CalloutExt type="tip">

content/docs/(docs)/writing-documentation/index.mdx

@@ -4,8 +4,6 @@ icon: PenLine
 description: How to contribute
 ---
 
-import { Step, Steps } from "fumadocs-ui/components/steps";
-
 Documentation is an integral part of ensuring the longevity of our systems, and it should not be taken lightly.
 
 Our goal is to document all systems as we develop them through prose, and for relevant software, through [OpenAPI](https://www.openapis.org/).

content/docs/(docs)/writing-documentation/pull-requests.mdx

@@ -4,8 +4,6 @@ icon: GitPullRequest
 description: Getting your code back to use
 ---
 
-import { Step, Steps } from "fumadocs-ui/components/steps";
-
 <Steps>
 <Step>
     ## Commit your changes

content/docs/infrastructure/in-smn/containers.mdx

@@ -0,0 +1,84 @@
+---
+title: Containers
+icon: Container
+description: How to run software in containers on the IN-SMN server using Docker Compose
+---
+
+<CalloutExt type="note">
+  This page assumes that you have SSH access to the IN-SMN server. It may still
+  be useful if you do not have access but are developing software that will be
+  deployed to our servers.
+</CalloutExt>
+
+Almost all software hosted on the IN-SMN server runs in Docker containers managed with [Docker Compose](https://docs.docker.com/compose/).
+
+Compose files are stored in two main locations:
+
+- `/root/SMN/docker-compose.yml` contains the configuration for core/static services that do not require automatic updates.
+  These include
+  [Traefik](./traefik),
+  [Authentik](../sso),
+  [Mosquitto](https://github.com/eclipse-mosquitto/mosquitto),
+  [LMixer](../../locale/software/lmixer),
+  and others.
+
+- `/home/deploy/` holds directories for automatically deployed applications,
+  which each have their own Compose file that references a published Docker image.
+  For details, see [Automatic deployment](#automatic-deployment).
+
+If a container hosts a website that should be accessible, it should define labels as detailed on the [Traefik page](./traefik).
+
+If you change a `docker-compose.yml` file, you can run `docker compose up -d` in its directory to restart only the affected containers.
+
+## Automatic deployment
+
+We use GitHub Actions to automatically build, push, pull, and restart containers
+on the server whenever changes are made to a project repository's main branch.
+
+Since we pretty much always do the same thing, we have a workflow that is reused.
+
+To set up automatic deployment:
+
+<Steps>
+<Step>
+Copy `/home/deploy/example-app` and modify its configuration as needed.
+</Step>
+<Step>
+Copy the [workflow template](https://github.com/itsektionen/andesite) and configure it as detailed in its README.
+</Step>
+<Step>
+The workflow connects to the server over SSH as the `deploy` user.
+Its credentials are stored as secrets in the chapter's [GitHub organization](https://github.com/itsektionen)
+and are exposed to workflows as `SSH_HOST`, `SSH_USERNAME`, and `SSH_KEY`.
+
+These secrets are made available automatically to workflows running on public repositories.
+If the repository is private, you need to add the SSH credentials manually.
+
+</Step>
+</Steps>
+
+### Configuring Andesite
+
+Andesite's behavior can be configured using inputs under `jobs.with`.
+
+**Example:** Enable caching with GHA:
+
+```yaml
+jobs:
+  secrets: inherit
+  with:
+    deploy-dir: docs
+    cache: "gha"
+    gha-mode: "min"
+```
+
+Here is a list of all options and their effects:
+
+| Key                    | Type           | Default        | Description                                                                                                                            |
+| ---------------------- | -------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| deploy-dir             | string         | N/A (required) | The folder containing `docker-compose.yaml`, e.g. `/home/deploy/<deploy-dir>/docker-compose.yaml`                                      |
+| context-dir            | string         | "."            | The folder containing the Dockerfile. Use this if it is not in the root directory. Prefix it with `./`, e.g. `./website/`              |
+| cache                  | "gha" or ""    | ""             | Enables caching during the Docker build step. "gha" caches all intermediate steps.                                                     |
+| gha-mode               | "min" or "max" | "min"          | Controls how aggressively "gha" caching is performed. See [GHA caching mode](https://docs.docker.com/build/cache/backends/#cache-mode) |
+| use-lfs                | boolean        | false          | Whether the repository uses LFS to track files                                                                                         |
+| limit-lfs-to-directory | string         | ""             | Fetches LFS files only from a specific folder rather than the entire repository. Useful for monorepos                                  |

content/docs/infrastructure/in-smn/meta.json

@@ -0,0 +1,4 @@
+{
+    "title": "IN-SMN",
+    "icon": "Server"
+}

content/docs/infrastructure/in-smn/traefik.mdx

@@ -0,0 +1,86 @@
+---
+title: Websites and routing
+icon: TrafficCone
+description: Routing web requests
+---
+
+<CalloutExt type="note">
+  This page assumes that you have SSH access to the IN-SMN server. It may still
+  be useful if you do not have access but are developing software that will be
+  deployed to our servers.
+</CalloutExt>
+
+We use [Traefik](https://doc.traefik.io/traefik/) to handle routing to our websites and to apply middleware.
+It is usually configured through [container labels](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/docker/)
+defined in project compose files, with the exception of when we need to route data to [IN-ITK](../servers#server-in-itk).
+{/* TODO: Document yaml config */} In this case we use YAML configs located in `/root/SMN/traefik/conf/`.
+
+The Traefik admin dashboard is hosted at [traefik.kth.it](https://traefik.kth.it/) for those with access.
+
+## Basic configuration
+
+Most required labels are boilerplate and will not vary significantly between deployments.
+The easiest approach to get up and running is to copy the labels of `/home/deploy/example-app` and modify them to fit the new deployment.
+
+## Adding authentication
+
+There are two types of authentication commonly used for deployments: HTTP Basic Auth and Authentik.
+Both are added by defining middleware with a Traefik label.
+To leave a site available to the entire internet, omit the middleware label.
+
+<Tabs items={["Authentik", "Basic Auth"]}>
+  <Tab value="Authentik">
+    <CalloutExt type="note">
+      To access a site with the Authentik middleware, it must be properly
+      configured through the Authentik dashboard. For details, see
+      [the SSO docs](../sso#configuration).
+    </CalloutExt>
+
+    ```yaml
+    # Label
+    - "traefik.http.routers.<APP_NAME>.middlewares=authentik@docker"
+    ```
+
+  </Tab>
+  <Tab value="Basic Auth">
+    <CalloutExt type="warning">
+      Basic Auth uses shared, static credentials and does not provide per-user
+      access control. Use Authentik for sensitive services.
+    </CalloutExt>
+
+    ```yaml
+    # Label
+    - "traefik.http.routers.<APP_NAME>.middlewares=basic-auth@docker"
+    ```
+
+  </Tab>
+</Tabs>
+
+## SSL encryption
+
+We use [Let's Encrypt](https://letsencrypt.org/) to obtain signed SSL certificates.
+Traefik automatically requests these for the domains and subdomains we use.
+
+Since these certificates are issued per subdomain rather than for all of `*.kth.it`,
+the browser will warn about a self-signed certificate if visiting a subdomain where nothing is served.
+
+### Adding new domains
+
+<Steps>
+  <Step>
+    Ensure that the DNS record points to IN-SMN.
+    This can be checked by pinging both the domain and `server.kth.it` and comparing the IPs.
+    You might need to wait a long while for the DNS propagation to finish.  
+    [Insert meme about DNS propagation being slow]
+
+    Note that for unused `*.kth.it` domains this step is already taken care of.
+  </Step>
+  <Step>
+    Setup the `Host(...)` rule(s) on the traefik configuration.
+  </Step>
+  <Step>
+    Start the container. Traefik will automatically detect the Hosts and request SSL certificates for them.
+
+    These certificates last for 90 days and are automatically renewed.
+  </Step>
+</Steps>

content/docs/infrastructure/meta.json

@@ -2,5 +2,13 @@
   "title": "Infrastructure",
   "description": "Docs for the chapter's digital infrastructure",
   "root": true,
-  "icon": "ServerCog"
-}
+  "icon": "ServerCog",
+  "pages": [
+    "---Local Server---",
+    "servers",
+    "...",
+    "in-smn",
+    "---External---",
+    "sso"
+  ]
+}

content/docs/infrastructure/network.mdx

@@ -0,0 +1,50 @@
+---
+title: Networking
+icon: Network
+description: How data gets to the right place
+---
+
+As detailed in [Servers](./servers), the chapter has two main servers in our
+locale: IN-SMN and IN-ITK. IN-SMN is the primary server and runs the vast
+majority of our self-hosted infrastructure and services. IN-ITK is managed by
+[ITK](https://itk.gg) and is primarily used to host game servers with
+[Pterodactyl](https://pterodactyl.io).
+
+## Incoming traffic
+
+The router forwards incoming traffic from the internet to IN-SMN or IN-ITK,
+depending on the destination port.
+
+HTTP(S) traffic (ports `80` and `443`) and standard SSH (port `22`), is sent to IN-SMN. 
+
+Since most games use higher-numbered ports, ports `>=2000` are directed to IN-ITK.
+As a consequence, SSH for IN-ITK uses port `2222` instead of the default `22` taken by IN-SMN.
+
+<CalloutExt type="note">
+  Since HTTP(S) traffic (ports 80 and 443) goes to IN-SMN, hosting websites on
+  IN-ITK requires IN-SMN to forward it to IN-ITK using [Traefik](in-smn/traefik).
+</CalloutExt>
+
+![Traffic from the internet reaches the router. HTTP, MQTT, and SSH traffic is sent to IN-SMN; game-server traffic is sent to IN-ITK; and Traefik on IN-SMN can forward HTTP traffic to IN-ITK.](networkexample.svg)
+
+## External hosting
+
+Some websites need better availability than our local servers can guarantee,
+such as [kth.it](https://kth.it) and the major committee websites.
+These should instead be hosted on an external hosting service, commonly
+[Netlify](https://www.netlify.com/) or sometimes [Vercel](https://vercel.com).
+
+Since the main [kth.it](https://kth.it) site ([Heim](../software/heim))
+is not hosted locally on IN-SMN, there are two separate DNS records.
+One record points the apex domain (`kth.it`) to Netlify
+and another points the wildcard `*.kth.it` to the chapter's public IP address.
+
+As a result, `kth.it` resolves to Netlify rather than the local router and
+cannot be used to connect to the chapter servers over SSH. Use
+`server.kth.it` instead.
+
+Some subdomains of `kth.it` are also hosted on Netlify,
+such as [init.kth.it](https://init.kth.it).
+An easy way to find out where a domain is hosted is to simply ping the domain.
+If it matches the IP for `kth.it`, it is Netlify, and if it matches `server.kth.it` it is
+IN-SMN (or IN-ITK).