halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(deploy): halkyon.li's forward through ramiel and its host at home (ADR 0039)

Browse source 
ramiel's HAProxy passes halkyon.li's TLS connections, unopened, through a
WireGuard tunnel to the instance at home, with the visitor's address in a
PROXY header, and everything else to ramiel's own Caddy, moved to the
loopback. Each end's nftables table lets the tunnel carry HAProxy's 443 and
the SSH jump's 22 alone, and nothing from home to ramiel.

The host at home: sshd with keys alone, the root disk unlocked over SSH at
boot (dropbear-initramfs, D20), Docker's and containerd's data bind-mounted
from the HDD, and home's end of the tunnel before Docker. An instance behind
the forward (compose.forwarded.yaml) publishes 443 on the tunnel's address
alone, trusts the PROXY header from ramiel alone, and gets its certificates
through TLS-ALPN, without HTTP/3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-11-08 19:05:47 +01:00
commit 29844c7fa6
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 871 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
deploy/host/docker-after-data.conf Normal file
View file

@ -0,0 +1,7 @@
# Docker's and containerd's data are bind mounts from the HDD (ADR 0039, D12:
# fstab-docker): both services start once they are in place. As
# /etc/systemd/system/docker.service.d/after-data.conf and
# /etc/systemd/system/containerd.service.d/after-data.conf on the instance's host at
# home.
[Unit]
RequiresMountsFor=/var/lib/docker /var/lib/containerd