a83a0b7d32
All checks were successful
PR build (required check) / changes (pull_request) Successful in 6s
PR build (required check) / build-backend (pull_request) Has been skipped
PR build (required check) / build-frontend (pull_request) Has been skipped
secrets-guard / encrypted (pull_request) Successful in 9s
shell-lint / shellcheck (pull_request) Successful in 7s
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 1s
Forgejo derives every absolute URL from its single ROOT_URL, so this is what moves clone URLs, the Google OAuth callback, webhook payload URLs and mail links onto the new domain. Both redirect URIs are registered on the Google OAuth client and were verified against Google before the flip — login is SSO-only, so a mismatch locks everyone out of the UI including out of undoing it. README documents the probe so the check is repeatable rather than assumed. git.thermograph.org stays on the same Caddy site block and stays load-bearing: the registry host baked into image names, the mesh /etc/hosts pins that make the /v2/* matcher see a mesh source IP, and the runners' registered instance URL all still use it. Renaming the registry is a separate migration; the docs now say so where someone would otherwise retire the name as dead weight. The stack has no auto-deploy, so this takes effect on a manual `docker stack deploy` from the manager.
50 lines
2.2 KiB
Text
50 lines
2.2 KiB
Text
# Only the block below (from "git.thermograph.org, dev.jinemi.com {") goes into
|
|
# the live Caddyfile — append just that part, not this instructional header, or
|
|
# it ends up as a confusing orphaned comment in production config with no
|
|
# surrounding context (docker-stack.yml isn't visible from there).
|
|
#
|
|
# Target: /etc/caddy/Caddyfile on vps1 (the box `forgejo` is pinned to — see
|
|
# docker-stack.yml; this is the box also called "vps1", 75.119.132.91).
|
|
# Reuses vps1's existing Caddy instead of a second reverse proxy/ACME flow:
|
|
# Forgejo publishes its web UI to 127.0.0.1:3080 only (host-local), and this
|
|
# block is the only thing that ever talks to it.
|
|
#
|
|
# TWO hostnames, ONE block, and that is load-bearing — see "Registry exposure"
|
|
# below. Both names must share a site block so the /v2/* restriction covers
|
|
# both. Splitting dev.jinemi.com into its own block serves the same Forgejo
|
|
# with the registry API open to the public internet.
|
|
#
|
|
# dev.jinemi.com is CANONICAL — it is Forgejo's ROOT_URL (docker-stack.yml,
|
|
# FORGEJO_DOMAIN), so it is the name Forgejo puts in clone URLs, the OAuth
|
|
# callback, webhook payload URLs and mail links.
|
|
#
|
|
# git.thermograph.org is kept as a served alias, NOT as dead weight: the
|
|
# registry host baked into image names, the mesh /etc/hosts pins and the
|
|
# runners' registered instance URL all still say git.thermograph.org. Removing
|
|
# this name from the block breaks CI, not just old bookmarks. Both names get
|
|
# their own Let's Encrypt cert automatically (HTTP-01); both A records point
|
|
# at vps1. See README.md, "Migrating the domain".
|
|
#
|
|
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
|
|
# /v2/* is the built-in OCI registry API. It's blocked from anywhere except
|
|
# the WireGuard mesh (10.10.0.0/24) — reachable to CI runners and Swarm nodes
|
|
# over wg0, not from the public internet. Everything else (web UI,
|
|
# git-over-HTTP, PR pages) stays public like the rest of the site.
|
|
|
|
# --- copy from here down into /etc/caddy/Caddyfile ---
|
|
|
|
git.thermograph.org, dev.jinemi.com {
|
|
encode zstd gzip
|
|
|
|
@registry_external {
|
|
path /v2/*
|
|
not remote_ip 10.10.0.0/24
|
|
}
|
|
respond @registry_external 403
|
|
|
|
reverse_proxy 127.0.0.1:3080
|
|
|
|
log {
|
|
output file /var/log/caddy/git.log
|
|
}
|
|
}
|