halkyon/deploy/forward/Caddyfile.halkyon-li

# What ramiel's Caddy (/etc/caddy/Caddyfile) gains for HAProxy in front of it (ADR 0039,
# D3, D10, D11). Not a Caddyfile of its own: the global options below go at the very
# top of ramiel's, before `code.halkyon.app {`, and the site at its end. Setting it up:
# forward/README.md.

# --- global options: the top of /etc/caddy/Caddyfile ---
{
	# HAProxy holds 443 and hands Caddy what isn't halkyon.li's on 8443, which ufw
	# keeps closed from outside. Port 80 stays Caddy's.
	https_port 8443
	servers :8443 {
		listener_wrappers {
			# The visitor's address from HAProxy's PROXY header, trusted from the
			# loopback alone, so the forge's log keeps visitors rather than
			# 127.0.0.1.
			proxy_protocol {
				timeout 5s
				allow 127.0.0.1/32 ::1/128
			}
			tls
		}
		# HTTP/3 runs over UDP, which HAProxy doesn't route: none, so no client is
		# sent to look for it.
		protocols h1 h2
	}
}

# --- sites: the end of /etc/caddy/Caddyfile ---
# ramiel's own names over plain HTTP, sent on to HTTPS by hand: with https_port 8443,
# Caddy's automatic redirects would send people to :8443, which is closed from outside.
# A site of its own on http:// takes a name's automatic redirect away; certificates are
# still issued on port 80 as before.
http://code.halkyon.app, http://halkyon.app, http://learn.halkyon.app {
	redir https://{host}{uri} 308
}

# halkyon.li over plain HTTP, sent on to HTTPS, which HAProxy passes home; nothing of
# halkyon.li is served or certified here.
http://halkyon.li, http://*.halkyon.li {
	redir https://{host}{uri} 308
}