Skip to content

deployment.md

Latest commit

 

History

History
101 lines (73 loc) · 2.33 KB

deployment.md

File metadata and controls

101 lines (73 loc) · 2.33 KB
Raw

Deployment

TLS Termination (Recommended)

ghp terminates TLS directly and uses SNI to select the right certificate for each virtualhost. This is the recommended production mode.

TLS Certificates

You need certificates covering:

  • api.github.com and github.com
  • *.githubcopilot.com
  • Your management host (e.g. ghp.example.com)

These can be separate certificates or combined using SANs. Configure them in server.yaml:

tls:
  certificates:
    - cert_file: "/etc/ghp/tls/github.pem"
      key_file: "/etc/ghp/tls/github-key.pem"
    - cert_file: "/etc/ghp/tls/copilot.pem"
      key_file: "/etc/ghp/tls/copilot-key.pem"
    - cert_file: "/etc/ghp/tls/mgmt.pem"
      key_file: "/etc/ghp/tls/mgmt-key.pem"

DNS

Point the GitHub hostnames at your ghp server on the network(s) where your agents run. This can be done via split-horizon DNS, /etc/hosts, or a local DNS resolver:

api.github.com      → <ghp-server-ip>
github.com          → <ghp-server-ip>
*.githubcopilot.com → <ghp-server-ip>

Agents then connect to ghp transparently — no client configuration beyond GH_TOKEN is needed.

Run Migrations

ghp migrate --config /etc/ghp/server.yaml

Systemd Unit

Create /etc/systemd/system/ghp.service:

[Unit]
Description=ghp — GitHub Proxy for Coding Agents
After=network.target postgresql.service

[Service]
Type=notify
ExecStart=/usr/local/bin/ghp serve --config /etc/ghp/server.yaml
User=ghp
Group=ghp
Restart=on-failure
WatchdogSec=30

Environment=GHP_ENCRYPTION_KEY=<your-key>

AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/ghp /var/log/ghp
PrivateTmp=yes

[Install]
WantedBy=multi-user.target

Start the service:

systemctl daemon-reload
systemctl enable --now ghp.service

Verify:

curl -s https://ghp.example.com/auth/status

Reverse Proxy Mode (Alternative)

If you prefer to run ghp behind a reverse proxy (e.g. Caddy, nginx) instead of having it terminate TLS directly, omit the https_listen, http_listen, and tls settings and use the legacy listen option:

server:
  listen: "unix:///run/ghp/ghp.sock"
  base_url: "https://ghp.example.com"

Then configure your reverse proxy to forward traffic to the socket. The reverse proxy handles TLS and routes the relevant Host headers to ghp.