halkyon/deploy/Caddyfile

# Caddy forwards to the API server, and profile pages (ADR 0011), the dictionaries
# devices download (ADR 0012), SimpleLogin's forwarding page (ADR 0020) and the
# privacy page (ADR 0021) to the web server (8082), which serves nothing else. Never the calls between the instance's
# services (`/halkyon-base/…`, ADR 0016): they reach each other on its own network. Insights (8081) doesn't run in production;
# if it is ever re-enabled, reach it through an SSH tunnel, never through this file.
#
# {$LEARN_DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
# {$ACCOUNT_SITE} is the account domain handles are on where it isn't {$LEARN_DOMAIN}
# (`halkyon.eu`), whose profile pages this instance serves; empty for none.
{$LEARN_DOMAIN} {$ACCOUNT_SITE} {
	encode zstd gzip

	# Profile pages, `/@handle`; asked for on the other host, they send the visitor to
	# their own address.
	@profile path /@*
	handle @profile {
		reverse_proxy server:8082
	}

	# The account domain serves profile pages alone. (An expression: a host matcher of
	# an empty variable would match every host.)
	@account expression `{host} == "{$ACCOUNT_SITE}"`
	handle @account {
		respond 404
	}

	# The instance's privacy page (Halkyon Learn's ADR 0021, D39), made from its
	# settings, readable before signing up.
	@privacy path /privacy
	handle @privacy {
		reverse_proxy server:8082
	}

	# SimpleLogin's forwarding page (ADR 0020): where SimpleLogin sends a sign-in back,
	# which sends it on to the app that began it, by the loopback or its scheme.
	@simplelogin path /simplelogin-callback
	handle @simplelogin {
		reverse_proxy server:8082
	}

	# Android's statement that Halkyon Learn, signed with the project's key
	# (tool/release/android-certificate.sha256), may open learn.halkyon.eu's links
	# itself (App Links): built for ADR 0020's D9, whose correction brings the
	# sign-in back through the app's scheme instead, and kept, as it costs
	# nothing. On learn.halkyon.eu alone, the one instance the
	# project's builds name: another operator's domain is no link of the project's
	# app. Written here rather than by the server, which knows no app's key.
	@assetlinks {
		host learn.halkyon.eu
		path /.well-known/assetlinks.json
	}
	handle @assetlinks {
		header Content-Type application/json
		respond `[{"relation":["delegate_permission/common.handle_all_urls"],"target":{"namespace":"android_app","package_name":"app.halkyon.learn","sha256_cert_fingerprints":["27:E2:43:FC:BD:C8:26:FF:98:AB:7D:BB:10:43:6C:98:C3:BE:A2:4B:2A:01:5E:94:E4:CF:C7:D1:FC:2A:00:6C"]}}]` 200
	}

	# The dictionaries devices download to look Japanese up by themselves, named by
	# their hashes; already compressed.
	handle /device-dictionaries/* {
		reverse_proxy server:8082
	}

	# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
	# Caddy puts the visitor's address last in X-Forwarded-For (what a visitor sends
	# there it replaces), which the server's per-network limits count by, as
	# TRUSTED_PROXIES names Caddy (compose.learn.yaml); the server never reads the Forwarded
	# header, which Caddy passes on as sent.
	handle {
		reverse_proxy server:8080
	}
}

# The sites of the sidecars switched on (sidecars/README.md), which their compose files
# mount into sidecars/; none without.
import sidecars/*.caddy