33 lines
1.1 KiB
Text
33 lines
1.1 KiB
Text
|
# What ramiel's Caddy (/etc/caddy/Caddyfile) gains for HAProxy in front of it (ADR 0039,
|
||
|
|
# D3, D10, D11). Not a Caddyfile of its own: the global options below go at the very
|
||
|
|
# top of ramiel's, before `code.halkyon.app {`, and the site at its end. Setting it up:
|
||
|
|
# forward/README.md.
|
||
|
|
|
||
|
|
# --- global options: the top of /etc/caddy/Caddyfile ---
|
||
|
|
{
|
||
|
|
# HAProxy holds 443 and hands Caddy what isn't halkyon.li's on 8443, which ufw
|
||
|
|
# keeps closed from outside. Port 80 stays Caddy's.
|
||
|
|
https_port 8443
|
||
|
|
servers :8443 {
|
||
|
|
listener_wrappers {
|
||
|
|
# The visitor's address from HAProxy's PROXY header, trusted from the
|
||
|
|
# loopback alone, so the forge's log keeps visitors rather than
|
||
|
|
# 127.0.0.1.
|
||
|
|
proxy_protocol {
|
||
|
|
timeout 5s
|
||
|
|
allow 127.0.0.1/32 ::1/128
|
||
|
|
}
|
||
|
|
tls
|
||
|
|
}
|
||
|
|
# HTTP/3 runs over UDP, which HAProxy doesn't route: none, so no client is
|
||
|
|
# sent to look for it.
|
||
|
|
protocols h1 h2
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# --- a site: the end of /etc/caddy/Caddyfile ---
|
||
|
|
# halkyon.li over plain HTTP, sent on to HTTPS, which HAProxy passes home; nothing of
|
||
|
|
# halkyon.li is served or certified here.
|
||
|
|
http://halkyon.li, http://*.halkyon.li {
|
||
|
|
redir https://{host}{uri} 308
|
||
|
|
}
|