# Only the block below (from "git.thermograph.org {") goes into the live
# Caddyfile — append just that part, not this instructional header, or it
# ends up as a confusing orphaned comment in production config with no
# surrounding context (docker-stack.yml isn't visible from there).
#
# Target: /etc/caddy/Caddyfile on vps1 (the box `forgejo` is pinned to — see
# docker-stack.yml; this is the box also called "vps1", 75.119.132.91).
# Reuses vps1's existing Caddy instead of a second reverse proxy/ACME flow:
# Forgejo publishes its web UI to 127.0.0.1:3080 only (host-local), and this
# block is the only thing that ever talks to it.
#
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
# git.thermograph.org/v2/* is the built-in OCI registry API. It's blocked
# from anywhere except the WireGuard mesh (10.10.0.0/24) — reachable to CI
# runners and Swarm nodes over wg0, not from the public internet. Everything
# else (web UI, git-over-HTTP, PR pages) stays public like the rest of the
# site.
#
# Update the domain below to match whatever you actually pointed at vps1's
# IP, if not git.thermograph.org.

# --- copy from here down into /etc/caddy/Caddyfile ---

git.thermograph.org {
	encode zstd gzip

	@registry_external {
		path /v2/*
		not remote_ip 10.10.0.0/24
	}
	respond @registry_external 403

	reverse_proxy 127.0.0.1:3080

	log {
		output file /var/log/caddy/git.log
	}
}