25 lines
862 B
Text
25 lines
862 B
Text
|
# Caddy's global options for an instance behind HAProxy (ADR 0039, D10, D11), which
|
||
|
|
# compose.forwarded.yaml mounts into /etc/caddy/global/ and the Caddyfile's global
|
||
|
|
# options import.
|
||
|
|
|
||
|
|
servers {
|
||
|
|
listener_wrappers {
|
||
|
|
# The visitor's address from HAProxy's PROXY header, trusted from ramiel's
|
||
|
|
# tunnel address alone (where Docker hands its connections on unchanged),
|
||
|
|
# so the servers' per-network limits count visitors, not ramiel.
|
||
|
|
proxy_protocol {
|
||
|
|
timeout 5s
|
||
|
|
allow 10.61.97.1/32
|
||
|
|
}
|
||
|
|
tls
|
||
|
|
}
|
||
|
|
# HTTP/3 runs over UDP, which HAProxy doesn't route: none, so no client is sent
|
||
|
|
# looking for it at ramiel, whose UDP 443 is its own Caddy's.
|
||
|
|
protocols h1 h2
|
||
|
|
}
|
||
|
|
|
||
|
|
# Certificates through the TLS-ALPN challenge alone, which reaches here through
|
||
|
|
# HAProxy unopened; port 80 isn't published, as ramiel answers it.
|
||
|
|
cert_issuer acme {
|
||
|
|
disable_http_challenge
|
||
|
|
}
|