thermograph/infra/deploy/Caddyfile.vps1

# /etc/caddy/Caddyfile on **vps1** (75.119.132.91) — the operational-programs box.
#
# vps1 serves:
#   emigriffith.dev            -> static portfolio site (from disk)
#   dev.jinemi.com             -> Forgejo, CANONICAL: both its ROOT_URL and the
#                                 registry host in every image name
#   git.thermograph.org        -> Forgejo, same site block — still served, now
#                                 only for already-pushed image tags carrying the
#                                 old prefix and for runners registered against
#                                 it (see deploy/forgejo/caddy-git.conf)
#
# Do not confuse `dev.jinemi.com` (Forgejo — git, CI, registry) with
# `dev.thermograph.org` (the dev *application* environment, further down this
# file). Same box, same word, unrelated services.
#   dashboard.thermograph.org  -> Grafana         (see observability/caddy-grafana.conf)
#
# and hosts the **dev** environment at dev.thermograph.org (below).
#
# beta.thermograph.org is NOT here either — beta moved to vps2, next to prod.
# That is the one edit in this file most likely to be made by mistake: a "beta"
# reference elsewhere in the repo that still points at 75.119.132.91 means this
# box, which no longer runs beta at all.
#
# Each domain's A/AAAA record must already point here — Caddy provisions a
# Let's Encrypt cert on first request and auto-renews.

emigriffith.dev {
	encode zstd gzip

	# Thermograph moved to its own domain. Send the old sub-path there with a
	# permanent redirect, stripping the /thermograph prefix so deep links map
	# straight across (…/thermograph/calendar -> thermograph.org/calendar). The
	# bare /thermograph (no trailing slash) goes to the new root.
	handle_path /thermograph/* {
		redir https://thermograph.org{uri} permanent
	}
	handle /thermograph {
		redir https://thermograph.org/ permanent
	}

	# Portfolio at the root. Point `root` at the built static site (for the Astro
	# portfolio that's its `dist/` output). file_server serves index.html for
	# directories and returns a real 404 for missing paths.
	handle {
		root * /var/www/emigriffith
		file_server
	}

	log {
		output file /var/log/caddy/emigriffith.log
	}
}

# Old bookmarks to the raw IP (the pre-domain URL) would otherwise get bounced to
# HTTPS-on-the-IP, which has no cert and fails. Redirect them to the portfolio domain.
http://75.119.132.91 {
	redir https://emigriffith.dev{uri} permanent
}

# Dev. Publicly resolvable, deliberately NOT publicly usable.
#
# Dev runs whatever branch is in flight — including unreviewed ones — on the
# same box as Forgejo and its CI runner. Three things make that acceptable, and
# all three are load-bearing:
#
#   1. The stack binds LOOPBACK (deploy/env-topology.sh sets DEV_BIND_ADDR to
#      127.0.0.1), so this site block is the only route in. Not even the mesh
#      reaches the app directly.
#   2. basic auth, so a stumbled-upon URL is not a running build.
#   3. X-Robots-Tag: noindex, so dev never competes with thermograph.org in a
#      search index the way a second copy of the same content otherwise would.
#
# Only :8137 is proxied. The dev overlay does not publish the frontend at all
# (docker-compose.dev.yml `ports: !reset null`) — the backend reverse-proxies to
# it internally, so one upstream serves the whole site here, unlike vps2 where
# Caddy path-splits across two ports.
#
# The credential below is a bcrypt hash, not a password. Rotate with:
#   caddy hash-password --plaintext '<new>'
dev.thermograph.org {
	encode zstd gzip

	header {
		X-Robots-Tag "noindex, nofollow"
	}

	# /healthz is deliberately OUTSIDE the auth boundary. It returns liveness and
	# nothing else — no data, no version, no configuration — and Centralis polls
	# it to report dev in `fleet_status`. Behind basic auth that poll gets a 401
	# and dev reads as permanently down, which is how a monitoring blind spot
	# gets created in the name of security.
	@protected not path /healthz

	basic_auth @protected {
		dev $2a$14$LU5sNyxbop3HOsjhXB6ZrOQiveqhbcYVE6.Wi0bydAv4QhNpj4HMC
	}

	reverse_proxy 127.0.0.1:8137 {
		health_uri /healthz
		health_interval 15s
		health_timeout 3s
		health_status 2xx
	}

	log {
		output file /var/log/caddy/dev.log {
			roll_size 20MiB
			roll_keep 5
		}
	}
}

# Optional: redirect www -> apex. Add the www CNAME/A record first, then
# uncomment.
# www.emigriffith.dev {
# 	redir https://emigriffith.dev{uri} permanent
# }