d138f00a20
Some checks failed
Sync infra to hosts / sync-beta (push) Has been skipped
Sync infra to hosts / sync-prod (push) Has been skipped
Sync infra to hosts / sync-dev (push) Failing after 6s
secrets-guard / encrypted (push) Successful in 6s
shell-lint / shellcheck (push) Successful in 13s
Validate observability stack / validate (push) Successful in 17s
PR build (required check) / changes (pull_request) Successful in 6s
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 6s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Successful in 18s
PR build (required check) / gate (pull_request) Successful in 2s
61 lines
2.5 KiB
Text
61 lines
2.5 KiB
Text
# /etc/caddy/Caddyfile on **vps1** (75.119.132.91) — the operational-programs box.
|
|
#
|
|
# vps1 serves:
|
|
# emigriffith.dev -> static portfolio site (from disk)
|
|
# git.thermograph.org -> Forgejo (see deploy/forgejo/caddy-git.conf)
|
|
# dashboard.thermograph.org -> Grafana (see observability/caddy-grafana.conf)
|
|
#
|
|
# and hosts the **dev** environment, which is deliberately ABSENT from this
|
|
# file. Dev has no site block, no DNS record and no certificate: it publishes on
|
|
# the WireGuard address only (http://10.10.0.2:8137) and is reachable from the
|
|
# mesh and nowhere else. Dev runs whatever branch is in flight, on the same box
|
|
# as Forgejo and its CI — putting it behind a public hostname would be handing
|
|
# the internet an unreviewed build. If you ever need it reachable from a phone,
|
|
# join the phone to the mesh; do not add a site block here.
|
|
#
|
|
# beta.thermograph.org is NOT here either — beta moved to vps2, next to prod.
|
|
# That is the one edit in this file most likely to be made by mistake: a "beta"
|
|
# reference elsewhere in the repo that still points at 75.119.132.91 means this
|
|
# box, which no longer runs beta at all.
|
|
#
|
|
# Each domain's A/AAAA record must already point here — Caddy provisions a
|
|
# Let's Encrypt cert on first request and auto-renews.
|
|
|
|
emigriffith.dev {
|
|
encode zstd gzip
|
|
|
|
# Thermograph moved to its own domain. Send the old sub-path there with a
|
|
# permanent redirect, stripping the /thermograph prefix so deep links map
|
|
# straight across (…/thermograph/calendar -> thermograph.org/calendar). The
|
|
# bare /thermograph (no trailing slash) goes to the new root.
|
|
handle_path /thermograph/* {
|
|
redir https://thermograph.org{uri} permanent
|
|
}
|
|
handle /thermograph {
|
|
redir https://thermograph.org/ permanent
|
|
}
|
|
|
|
# Portfolio at the root. Point `root` at the built static site (for the Astro
|
|
# portfolio that's its `dist/` output). file_server serves index.html for
|
|
# directories and returns a real 404 for missing paths.
|
|
handle {
|
|
root * /var/www/emigriffith
|
|
file_server
|
|
}
|
|
|
|
log {
|
|
output file /var/log/caddy/emigriffith.log
|
|
}
|
|
}
|
|
|
|
# Old bookmarks to the raw IP (the pre-domain URL) would otherwise get bounced to
|
|
# HTTPS-on-the-IP, which has no cert and fails. Redirect them to the portfolio domain.
|
|
http://75.119.132.91 {
|
|
redir https://emigriffith.dev{uri} permanent
|
|
}
|
|
|
|
# Optional: redirect www -> apex. Add the www CNAME/A record first, then
|
|
# uncomment.
|
|
# www.emigriffith.dev {
|
|
# redir https://emigriffith.dev{uri} permanent
|
|
# }
|