# Only the block below (from "git.thermograph.org, dev.jinemi.com {") goes into
# the live Caddyfile — append just that part, not this instructional header, or
# it ends up as a confusing orphaned comment in production config with no
# surrounding context (docker-stack.yml isn't visible from there).
#
# Target: /etc/caddy/Caddyfile on vps1 (the box `forgejo` is pinned to — see
# docker-stack.yml; this is the box also called "vps1", 75.119.132.91).
# Reuses vps1's existing Caddy instead of a second reverse proxy/ACME flow:
# Forgejo publishes its web UI to 127.0.0.1:3080 only (host-local), and this
# block is the only thing that ever talks to it.
#
# TWO hostnames, ONE block, and that is load-bearing — see "Registry exposure"
# below. Both names must share a site block so the /v2/* restriction covers
# both. Splitting dev.jinemi.com into its own block serves the same Forgejo
# with the registry API open to the public internet.
#
# dev.jinemi.com is the migration target for git.thermograph.org; both are
# served during the transition. Each gets its own Let's Encrypt cert
# automatically (HTTP-01) — both A records already point at vps1.
#
# git.thermograph.org stays CANONICAL until Forgejo's ROOT_URL is flipped
# (docker-stack.yml, FORGEJO_DOMAIN). Until then dev.jinemi.com serves every
# page, but Forgejo builds absolute URLs from ROOT_URL, so clone URLs, the
# OAuth callback and post-login redirects still name git.thermograph.org.
# Flipping it is NOT just this file — see README.md, "Migrating the domain".
#
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
# /v2/* is the built-in OCI registry API. It's blocked from anywhere except
# the WireGuard mesh (10.10.0.0/24) — reachable to CI runners and Swarm nodes
# over wg0, not from the public internet. Everything else (web UI,
# git-over-HTTP, PR pages) stays public like the rest of the site.

# --- copy from here down into /etc/caddy/Caddyfile ---

git.thermograph.org, dev.jinemi.com {
	encode zstd gzip

	@registry_external {
		path /v2/*
		not remote_ip 10.10.0.0/24
	}
	respond @registry_external 403

	reverse_proxy 127.0.0.1:3080

	log {
		output file /var/log/caddy/git.log
	}
}