120 lines
4.5 KiB
Caddyfile
120 lines
4.5 KiB
Caddyfile
# /etc/caddy/Caddyfile on the VPS.
|
|
# Each domain's A/AAAA record must already point at this VPS — Caddy provisions a
|
|
# Let's Encrypt cert on first request and auto-renews. Nothing else to do for TLS
|
|
# (just make sure ports 80 and 443 are open).
|
|
#
|
|
# Layout:
|
|
# thermograph.org/* -> the Thermograph app (path-split across
|
|
# backend/frontend -- see below)
|
|
# emigriffith.dev/ -> static portfolio site (served straight from disk)
|
|
# emigriffith.dev/thermograph* -> permanent redirect to thermograph.org (the app moved)
|
|
#
|
|
# Thermograph now owns thermograph.org's root, so both services run with
|
|
# THERMOGRAPH_BASE=/ (see /etc/thermograph.env) — pages, assets and API all sit
|
|
# at "/" with no sub-path prefix. Repo-split Stage 4: backend and frontend are
|
|
# two containers now (docker-compose.yml), each on its own loopback port --
|
|
# Caddy path-splits directly to whichever owns a given path, so the browser
|
|
# still sees one apparent origin. Repo-split Stage 7a flipped which side owns
|
|
# the enumerated list: frontend now owns everything (content pages, the
|
|
# interactive tool's SPA shells, every static asset, the dynamic IndexNow key
|
|
# file) except the short, stable set below, which mirrors backend/web/app.py's
|
|
# own routing exactly (a single catch-all proxy to frontend for everything
|
|
# else) -- unlike frontend's paths, backend's don't grow every time a new
|
|
# static asset filename is added. A gap in this list still just degrades to
|
|
# "one extra hop" through backend's own proxy fallback, never a 404.
|
|
|
|
thermograph.org {
|
|
encode zstd gzip
|
|
|
|
@backend_paths path /api/* /digest /discord/interactions
|
|
|
|
# Active health check on the same cheap /healthz route each container's own
|
|
# HEALTHCHECK uses (Dockerfile) — so a deploy that's still restarting/booting
|
|
# never gets proxied into (a reload alone has no gate, hop-1 runbook hazard #10).
|
|
# 15s (was 5s): plenty responsive for a process that only restarts on a deploy,
|
|
# and a quarter of the polling load.
|
|
handle @backend_paths {
|
|
reverse_proxy 127.0.0.1:8137 {
|
|
health_uri /healthz
|
|
health_interval 15s
|
|
health_timeout 3s
|
|
health_status 2xx
|
|
}
|
|
}
|
|
|
|
handle {
|
|
reverse_proxy 127.0.0.1:8080 {
|
|
health_uri /healthz
|
|
health_interval 15s
|
|
health_timeout 3s
|
|
health_status 2xx
|
|
}
|
|
}
|
|
|
|
# Access-log hygiene: the default JSON encoder serializes full request headers,
|
|
# the TLS block, and response headers on every line (measured ~1,133B/line) --
|
|
# strip those with the `filter` format encoder. Also strip the query string from
|
|
# the logged URI: Caddy's default logger records request.uri *including* the
|
|
# query string, so every `?q=<search text>` a visitor typed sat in Loki next to
|
|
# their client IP for the full 30-day retention -- a real privacy leak, not just
|
|
# noise. Bot/crawler skipping stays out of here: `log_skip` needs Caddy >= 2.7
|
|
# and an upgrade is out of scope, so that's handled downstream in Alloy's
|
|
# loki.process "caddy" stage instead (see observability/alloy/config.alloy).
|
|
log {
|
|
output file /var/log/caddy/thermograph.log {
|
|
roll_size 20MiB
|
|
roll_keep 5
|
|
}
|
|
format filter {
|
|
wrap json
|
|
fields {
|
|
request>headers delete
|
|
request>tls delete
|
|
resp_headers delete
|
|
request>uri regexp \?.* ""
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
emigriffith.dev {
|
|
encode zstd gzip
|
|
|
|
# Thermograph moved to its own domain. Send the old sub-path there with a
|
|
# permanent redirect, stripping the /thermograph prefix so deep links map
|
|
# straight across (…/thermograph/calendar -> thermograph.org/calendar). The
|
|
# bare /thermograph (no trailing slash) goes to the new root.
|
|
handle_path /thermograph/* {
|
|
redir https://thermograph.org{uri} permanent
|
|
}
|
|
handle /thermograph {
|
|
redir https://thermograph.org/ permanent
|
|
}
|
|
|
|
# Portfolio at the root. Point `root` at the built static site (for the Astro
|
|
# portfolio that's its `dist/` output). file_server serves index.html for
|
|
# directories and returns a real 404 for missing paths.
|
|
handle {
|
|
root * /var/www/emigriffith
|
|
file_server
|
|
}
|
|
|
|
log {
|
|
output file /var/log/caddy/emigriffith.log
|
|
}
|
|
}
|
|
|
|
# Old bookmarks to the raw IP (the pre-domain URL) would otherwise get bounced to
|
|
# HTTPS-on-the-IP, which has no cert and fails. Redirect them to the portfolio domain.
|
|
http://75.119.132.91 {
|
|
redir https://emigriffith.dev{uri} permanent
|
|
}
|
|
|
|
# Optional: redirect www -> apex for either domain. Add the www CNAME/A record
|
|
# first, then uncomment the matching block.
|
|
# www.emigriffith.dev {
|
|
# redir https://emigriffith.dev{uri} permanent
|
|
# }
|
|
# www.thermograph.org {
|
|
# redir https://thermograph.org{uri} permanent
|
|
# }
|