halkyon/deploy/Caddyfile

# Caddy forwards to the API server, and profile pages (ADR 0011) and the dictionaries
# devices download (ADR 0012) to the web server (8082), which serves nothing else. Never the calls between the instance's
# services (`/halkyon-base/…`, ADR 0016): they reach each other on its own network. Insights (8081) doesn't run in production;
# if it is ever re-enabled, reach it through an SSH tunnel, never through this file.
#
# {$DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
# {$ACCOUNT_SITE} is the account domain handles are on where it isn't {$DOMAIN}
# (`halkyon.eu`), whose profile pages this instance serves; empty for none.
{$DOMAIN} {$ACCOUNT_SITE} {
	encode zstd gzip

	# Profile pages, `/@handle`; asked for on the other host, they send the visitor to
	# their own address.
	@profile path /@*
	handle @profile {
		reverse_proxy server:8082
	}

	# The account domain serves profile pages alone. (An expression: a host matcher of
	# an empty variable would match every host.)
	@account expression `{host} == "{$ACCOUNT_SITE}"`
	handle @account {
		respond 404
	}

	# The dictionaries devices download to look Japanese up by themselves, named by
	# their hashes; already compressed.
	handle /device-dictionaries/* {
		reverse_proxy server:8082
	}

	# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
	# Caddy puts the visitor's address last in X-Forwarded-For (what a visitor sends
	# there it replaces), which the server's per-network limits count by, as
	# TRUSTED_PROXIES names Caddy (compose.yaml); the server never reads the Forwarded
	# header, which Caddy passes on as sent.
	handle {
		reverse_proxy server:8080
	}
}

# The sites of the sidecars switched on (sidecars/README.md), which their compose files
# mount into sidecars/; none without.
import sidecars/*.caddy