# Only the block below (from "dev.jinemi.com, git.thermograph.org {") goes into
# the live Caddyfile — append just that part, not this instructional header, or
# it ends up as a confusing orphaned comment in production config with no
# surrounding context (docker-stack.yml isn't visible from there).
#
# Target: /etc/caddy/Caddyfile on vps1 (the box `forgejo` is pinned to — see
# docker-stack.yml; this is the box also called "vps1", 75.119.132.91).
# Reuses vps1's existing Caddy instead of a second reverse proxy/ACME flow:
# Forgejo publishes its web UI to 127.0.0.1:3080 only (host-local), and this
# block is the only thing that ever talks to it.
#
# TWO hostnames, ONE block, and that is load-bearing — see "Registry exposure"
# below. Both names must share a site block so the /v2/* restriction covers
# both. Splitting dev.jinemi.com into its own block serves the same Forgejo
# with the registry API open to the public internet.
#
# dev.jinemi.com is CANONICAL, now on both axes — it is Forgejo's ROOT_URL
# (docker-stack.yml, FORGEJO_DOMAIN), so it is the name Forgejo puts in clone
# URLs, the OAuth callback, webhook payload URLs and mail links; and it is the
# registry host in every image name this repo builds or pulls.
#
# git.thermograph.org is kept as a served alias, NOT as dead weight, though the
# reason narrowed when the registry moved. What still needs it: image tags
# already pushed under the old prefix (a rollback to one names that host), and
# runners registered against `https://git.thermograph.org`, which hold the
# instance URL they registered with. Removing this name from the block breaks a
# rollback and de-registers runners — not just old bookmarks. Both names get
# their own Let's Encrypt cert automatically (HTTP-01); both A records point
# at vps1. See README.md, "Migrating the domain".
#
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
# /v2/* is the built-in OCI registry API. It's blocked from anywhere except
# the WireGuard mesh (10.10.0.0/24) — reachable to CI runners and Swarm nodes
# over wg0, not from the public internet. Everything else (web UI,
# git-over-HTTP, PR pages) stays public like the rest of the site.

# --- copy from here down into /etc/caddy/Caddyfile ---

dev.jinemi.com, git.thermograph.org {
	encode zstd gzip

	@registry_external {
		path /v2/*
		not remote_ip 10.10.0.0/24
	}
	respond @registry_external 403

	reverse_proxy 127.0.0.1:3080

	log {
		output file /var/log/caddy/git.log
	}
}