24 lines
1.2 KiB
Markdown
24 lines
1.2 KiB
Markdown
# ECP-0103: Mullvad Philadelphia Egress for Forge NBC Philadelphia
|
|
|
|
## Why
|
|
|
|
The forge-side NBC worker is currently dependent on a reverse-tunneled proxy for US egress.
|
|
That is enough to prove the geo-boundary, but it is the wrong long-term operator shape for `NBC Sports Philadelphia`.
|
|
|
|
## Decision
|
|
|
|
1. Enable the Mullvad daemon on `ecp-forge`.
|
|
2. Keep the Mullvad account number out of committed Nix configuration; log in operationally from founder-provided material.
|
|
3. Use a Philadelphia Mullvad relay for `NBC Sports Philadelphia` work on forge.
|
|
4. Start the forge NBC publish worker after the Mullvad daemon is available.
|
|
|
|
## Consequences
|
|
|
|
- Forge NBC egress becomes self-contained instead of depending on a local reverse proxy.
|
|
- The account credential stays operational-only rather than being copied into repo config.
|
|
- Relay choice remains runtime-controlled, so it can be swapped if a specific Philadelphia host degrades.
|
|
|
|
## Rejected Alternatives
|
|
|
|
- Keep relying on the reverse-tunneled local proxy: rejected because it couples forge origin to a founder workstation.
|
|
- Commit the Mullvad account number into NixOS config: rejected because it expands secret exposure for no benefit.
|