441af55084
beta (Forgejo's pinned node) is also today's live thermograph.org host, with Caddy already bound to ports 80/443. A second reverse proxy binding those same ports would collide with it. Drop Traefik entirely: forgejo's web port now publishes to 127.0.0.1:3080 only, and a new Caddy site block (deploy/forgejo/caddy-git.conf) reverse-proxies git.thermograph.org to it, reusing Caddy's existing automatic-HTTPS instead of a second ACME flow. That same Caddy block resolves the registry-exposure question (hazard #15 in the hop1 runbook) as its first listed option: /v2/* (the registry API) is blocked to everything outside the WireGuard mesh CIDR, while the git/web UI stays public. README documents the /etc/hosts override mesh clients need so registry traffic actually routes over the tunnel rather than the public IP.
31 lines
1 KiB
Text
31 lines
1 KiB
Text
# Append this block to /etc/caddy/Caddyfile on beta (the box this stack's
|
|
# `forgejo` service is pinned to — see docker-stack.yml). Reuses beta's
|
|
# existing Caddy instead of a second reverse proxy/ACME flow: Forgejo
|
|
# publishes its web UI to 127.0.0.1:3080 only (host-local), and this block is
|
|
# the only thing that ever talks to it.
|
|
#
|
|
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
|
|
# git.thermograph.org/v2/* is the built-in OCI registry API. It's blocked
|
|
# from anywhere except the WireGuard mesh (10.10.0.0/24) — reachable to CI
|
|
# runners and Swarm nodes over wg0, not from the public internet. Everything
|
|
# else (web UI, git-over-HTTP, PR pages) stays public like the rest of the
|
|
# site.
|
|
#
|
|
# Update FORGEJO_DOMAIN below to match whatever domain you actually pointed
|
|
# at beta's IP if it's not git.thermograph.org.
|
|
|
|
git.thermograph.org {
|
|
encode zstd gzip
|
|
|
|
@registry_external {
|
|
path /v2/*
|
|
not remote_ip 10.10.0.0/24
|
|
}
|
|
respond @registry_external 403
|
|
|
|
reverse_proxy 127.0.0.1:3080
|
|
|
|
log {
|
|
output file /var/log/caddy/git.log
|
|
}
|
|
}
|