396b80cf91
Both hostnames go on a single Caddy site block. That is load-bearing rather than cosmetic: the /v2/* mesh-only matcher that keeps the OCI registry API off the public internet (hazard #15) is scoped per block, so a separate block for the new name would serve the same Forgejo with the registry open. git.thermograph.org stays canonical — Forgejo has one ROOT_URL and builds every absolute URL from it, so clone URLs, the OAuth callback and post-login redirects keep naming the .org host. Flipping FORGEJO_DOMAIN additionally requires the Google OAuth redirect URI, the registry host baked into image names and runner labels, and the mesh /etc/hosts pins; README documents those prerequisites. Config verified with `caddy validate` and by asserting against the adapted JSON that the /v2 403 guard matches both hostnames.
111 lines
4 KiB
Text
111 lines
4 KiB
Text
# /etc/caddy/Caddyfile on **vps1** (75.119.132.91) — the operational-programs box.
|
|
#
|
|
# vps1 serves:
|
|
# emigriffith.dev -> static portfolio site (from disk)
|
|
# git.thermograph.org -> Forgejo (see deploy/forgejo/caddy-git.conf)
|
|
# dev.jinemi.com -> Forgejo, same site block — migration target for
|
|
# git.thermograph.org, both served, the .org one
|
|
# still canonical (that file's header explains)
|
|
# dashboard.thermograph.org -> Grafana (see observability/caddy-grafana.conf)
|
|
#
|
|
# and hosts the **dev** environment at dev.thermograph.org (below).
|
|
#
|
|
# beta.thermograph.org is NOT here either — beta moved to vps2, next to prod.
|
|
# That is the one edit in this file most likely to be made by mistake: a "beta"
|
|
# reference elsewhere in the repo that still points at 75.119.132.91 means this
|
|
# box, which no longer runs beta at all.
|
|
#
|
|
# Each domain's A/AAAA record must already point here — Caddy provisions a
|
|
# Let's Encrypt cert on first request and auto-renews.
|
|
|
|
emigriffith.dev {
|
|
encode zstd gzip
|
|
|
|
# Thermograph moved to its own domain. Send the old sub-path there with a
|
|
# permanent redirect, stripping the /thermograph prefix so deep links map
|
|
# straight across (…/thermograph/calendar -> thermograph.org/calendar). The
|
|
# bare /thermograph (no trailing slash) goes to the new root.
|
|
handle_path /thermograph/* {
|
|
redir https://thermograph.org{uri} permanent
|
|
}
|
|
handle /thermograph {
|
|
redir https://thermograph.org/ permanent
|
|
}
|
|
|
|
# Portfolio at the root. Point `root` at the built static site (for the Astro
|
|
# portfolio that's its `dist/` output). file_server serves index.html for
|
|
# directories and returns a real 404 for missing paths.
|
|
handle {
|
|
root * /var/www/emigriffith
|
|
file_server
|
|
}
|
|
|
|
log {
|
|
output file /var/log/caddy/emigriffith.log
|
|
}
|
|
}
|
|
|
|
# Old bookmarks to the raw IP (the pre-domain URL) would otherwise get bounced to
|
|
# HTTPS-on-the-IP, which has no cert and fails. Redirect them to the portfolio domain.
|
|
http://75.119.132.91 {
|
|
redir https://emigriffith.dev{uri} permanent
|
|
}
|
|
|
|
# Dev. Publicly resolvable, deliberately NOT publicly usable.
|
|
#
|
|
# Dev runs whatever branch is in flight — including unreviewed ones — on the
|
|
# same box as Forgejo and its CI runner. Three things make that acceptable, and
|
|
# all three are load-bearing:
|
|
#
|
|
# 1. The stack binds LOOPBACK (deploy/env-topology.sh sets DEV_BIND_ADDR to
|
|
# 127.0.0.1), so this site block is the only route in. Not even the mesh
|
|
# reaches the app directly.
|
|
# 2. basic auth, so a stumbled-upon URL is not a running build.
|
|
# 3. X-Robots-Tag: noindex, so dev never competes with thermograph.org in a
|
|
# search index the way a second copy of the same content otherwise would.
|
|
#
|
|
# Only :8137 is proxied. The dev overlay does not publish the frontend at all
|
|
# (docker-compose.dev.yml `ports: !reset null`) — the backend reverse-proxies to
|
|
# it internally, so one upstream serves the whole site here, unlike vps2 where
|
|
# Caddy path-splits across two ports.
|
|
#
|
|
# The credential below is a bcrypt hash, not a password. Rotate with:
|
|
# caddy hash-password --plaintext '<new>'
|
|
dev.thermograph.org {
|
|
encode zstd gzip
|
|
|
|
header {
|
|
X-Robots-Tag "noindex, nofollow"
|
|
}
|
|
|
|
# /healthz is deliberately OUTSIDE the auth boundary. It returns liveness and
|
|
# nothing else — no data, no version, no configuration — and Centralis polls
|
|
# it to report dev in `fleet_status`. Behind basic auth that poll gets a 401
|
|
# and dev reads as permanently down, which is how a monitoring blind spot
|
|
# gets created in the name of security.
|
|
@protected not path /healthz
|
|
|
|
basic_auth @protected {
|
|
dev $2a$14$LU5sNyxbop3HOsjhXB6ZrOQiveqhbcYVE6.Wi0bydAv4QhNpj4HMC
|
|
}
|
|
|
|
reverse_proxy 127.0.0.1:8137 {
|
|
health_uri /healthz
|
|
health_interval 15s
|
|
health_timeout 3s
|
|
health_status 2xx
|
|
}
|
|
|
|
log {
|
|
output file /var/log/caddy/dev.log {
|
|
roll_size 20MiB
|
|
roll_keep 5
|
|
}
|
|
}
|
|
}
|
|
|
|
# Optional: redirect www -> apex. Add the www CNAME/A record first, then
|
|
# uncomment.
|
|
# www.emigriffith.dev {
|
|
# redir https://emigriffith.dev{uri} permanent
|
|
# }
|