441af55084
beta (Forgejo's pinned node) is also today's live thermograph.org host, with Caddy already bound to ports 80/443. A second reverse proxy binding those same ports would collide with it. Drop Traefik entirely: forgejo's web port now publishes to 127.0.0.1:3080 only, and a new Caddy site block (deploy/forgejo/caddy-git.conf) reverse-proxies git.thermograph.org to it, reusing Caddy's existing automatic-HTTPS instead of a second ACME flow. That same Caddy block resolves the registry-exposure question (hazard #15 in the hop1 runbook) as its first listed option: /v2/* (the registry API) is blocked to everything outside the WireGuard mesh CIDR, while the git/web UI stays public. README documents the /etc/hosts override mesh clients need so registry traffic actually routes over the tunnel rather than the public IP. |
||
|---|---|---|
| .. | ||
| db | ||
| forgejo | ||
| openmeteo | ||
| swarm | ||
| Caddyfile | ||
| deploy.sh | ||
| POSTGRES-MIGRATION.md | ||
| provision-agent-access.sh | ||
| provision-mail.sh | ||
| thermograph-dev.service | ||
| thermograph.env.example | ||
| thermograph.service | ||