d138f00a20
Some checks failed
Sync infra to hosts / sync-beta (push) Has been skipped
Sync infra to hosts / sync-prod (push) Has been skipped
Sync infra to hosts / sync-dev (push) Failing after 6s
secrets-guard / encrypted (push) Successful in 6s
shell-lint / shellcheck (push) Successful in 13s
Validate observability stack / validate (push) Successful in 17s
PR build (required check) / changes (pull_request) Successful in 6s
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 6s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Successful in 18s
PR build (required check) / gate (pull_request) Successful in 2s
38 lines
1.4 KiB
Text
38 lines
1.4 KiB
Text
# Only the block below (from "git.thermograph.org {") goes into the live
|
|
# Caddyfile — append just that part, not this instructional header, or it
|
|
# ends up as a confusing orphaned comment in production config with no
|
|
# surrounding context (docker-stack.yml isn't visible from there).
|
|
#
|
|
# Target: /etc/caddy/Caddyfile on vps1 (the box `forgejo` is pinned to — see
|
|
# docker-stack.yml; this is the box also called "vps1", 75.119.132.91).
|
|
# Reuses vps1's existing Caddy instead of a second reverse proxy/ACME flow:
|
|
# Forgejo publishes its web UI to 127.0.0.1:3080 only (host-local), and this
|
|
# block is the only thing that ever talks to it.
|
|
#
|
|
# Registry exposure (hazard #15, see docker-stack.yml's header comment):
|
|
# git.thermograph.org/v2/* is the built-in OCI registry API. It's blocked
|
|
# from anywhere except the WireGuard mesh (10.10.0.0/24) — reachable to CI
|
|
# runners and Swarm nodes over wg0, not from the public internet. Everything
|
|
# else (web UI, git-over-HTTP, PR pages) stays public like the rest of the
|
|
# site.
|
|
#
|
|
# Update the domain below to match whatever you actually pointed at vps1's
|
|
# IP, if not git.thermograph.org.
|
|
|
|
# --- copy from here down into /etc/caddy/Caddyfile ---
|
|
|
|
git.thermograph.org {
|
|
encode zstd gzip
|
|
|
|
@registry_external {
|
|
path /v2/*
|
|
not remote_ip 10.10.0.0/24
|
|
}
|
|
respond @registry_external 403
|
|
|
|
reverse_proxy 127.0.0.1:3080
|
|
|
|
log {
|
|
output file /var/log/caddy/git.log
|
|
}
|
|
}
|