396b80cf91
Both hostnames go on a single Caddy site block. That is load-bearing rather than cosmetic: the /v2/* mesh-only matcher that keeps the OCI registry API off the public internet (hazard #15) is scoped per block, so a separate block for the new name would serve the same Forgejo with the registry open. git.thermograph.org stays canonical — Forgejo has one ROOT_URL and builds every absolute URL from it, so clone URLs, the OAuth callback and post-login redirects keep naming the .org host. Flipping FORGEJO_DOMAIN additionally requires the Google OAuth redirect URI, the registry host baked into image names and runner labels, and the mesh /etc/hosts pins; README documents those prerequisites. Config verified with `caddy validate` and by asserting against the adapted JSON that the /v2 403 guard matches both hostnames.
49 lines
2.1 KiB
Text
49 lines
2.1 KiB
Text
# Only the block below (from "git.thermograph.org, dev.jinemi.com {") goes into
|
|
# the live Caddyfile — append just that part, not this instructional header, or
|
|
# it ends up as a confusing orphaned comment in production config with no
|
|
# surrounding context (docker-stack.yml isn't visible from there).
|
|
#
|
|
# Target: /etc/caddy/Caddyfile on vps1 (the box `forgejo` is pinned to — see
|
|
# docker-stack.yml; this is the box also called "vps1", 75.119.132.91).
|
|
# Reuses vps1's existing Caddy instead of a second reverse proxy/ACME flow:
|
|
# Forgejo publishes its web UI to 127.0.0.1:3080 only (host-local), and this
|
|
# block is the only thing that ever talks to it.
|
|
#
|
|
# TWO hostnames, ONE block, and that is load-bearing — see "Registry exposure"
|
|
# below. Both names must share a site block so the /v2/* restriction covers
|
|
# both. Splitting dev.jinemi.com into its own block serves the same Forgejo
|
|
# with the registry API open to the public internet.
|
|
#
|
|
# dev.jinemi.com is the migration target for git.thermograph.org; both are
|
|
# served during the transition. Each gets its own Let's Encrypt cert
|
|
# automatically (HTTP-01) — both A records already point at vps1.
|
|
#
|
|
# git.thermograph.org stays CANONICAL until Forgejo's ROOT_URL is flipped
|
|
# (docker-stack.yml, FORGEJO_DOMAIN). Until then dev.jinemi.com serves every
|
|
# page, but Forgejo builds absolute URLs from ROOT_URL, so clone URLs, the
|
|
# OAuth callback and post-login redirects still name git.thermograph.org.
|
|
# Flipping it is NOT just this file — see README.md, "Migrating the domain".
|
|
#
|
|
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
|
|
# /v2/* is the built-in OCI registry API. It's blocked from anywhere except
|
|
# the WireGuard mesh (10.10.0.0/24) — reachable to CI runners and Swarm nodes
|
|
# over wg0, not from the public internet. Everything else (web UI,
|
|
# git-over-HTTP, PR pages) stays public like the rest of the site.
|
|
|
|
# --- copy from here down into /etc/caddy/Caddyfile ---
|
|
|
|
git.thermograph.org, dev.jinemi.com {
|
|
encode zstd gzip
|
|
|
|
@registry_external {
|
|
path /v2/*
|
|
not remote_ip 10.10.0.0/24
|
|
}
|
|
respond @registry_external 403
|
|
|
|
reverse_proxy 127.0.0.1:3080
|
|
|
|
log {
|
|
output file /var/log/caddy/git.log
|
|
}
|
|
}
|