halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

fix(deploy): ramiel's own names redirected to HTTPS by hand behind HAProxy (ADR 0039)

Browse source 
With https_port 8443, Caddy's automatic HTTP-to-HTTPS redirects would send
visitors of code.halkyon.app, halkyon.app and learn.halkyon.app to :8443,
which is closed from outside. A site of their own on http:// redirects them
to the default port instead. The README's step for home's key points at the
host's step 5, and checks that 8443 stays closed and the redirect carries no
port.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-11-08 20:22:13 +01:00
commit fb5eda87e9
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 32 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
deploy/forward/Caddyfile.halkyon-li
View file

@ -25,7 +25,15 @@
}
}
# --- a site: the end of /etc/caddy/Caddyfile ---
# --- sites: the end of /etc/caddy/Caddyfile ---
# ramiel's own names over plain HTTP, sent on to HTTPS by hand: with https_port 8443,
# Caddy's automatic redirects would send people to :8443, which is closed from outside.
# A site of its own on http:// takes a name's automatic redirect away; certificates are
# still issued on port 80 as before.
http://code.halkyon.app, http://halkyon.app, http://learn.halkyon.app {
redir https://{host}{uri} 308
}
# halkyon.li over plain HTTP, sent on to HTTPS, which HAProxy passes home; nothing of
# halkyon.li is served or certified here.
http://halkyon.li, http://*.halkyon.li {

7
deploy/forward/README.md
View file

@ -46,7 +46,7 @@ alongside (`../host/README.md`): each side needs the other's public key.
sudo wg pubkey < /etc/wireguard/wg-halkyon.key # ramiel's public key: home's config
```
4. **The tunnel's files**, with home's public key (from `../host/README.md`, step 4) in
4. **The tunnel's files**, with home's public key (from `../host/README.md`, step 5) in
place of `<home's public key>`:
```sh
@ -71,9 +71,11 @@ alongside (`../host/README.md`): each side needs the other's public key.
7. **Caddy moved behind HAProxy.** Keep the Caddyfile as it is, then put
`Caddyfile.halkyon-li`'s global options at the very top of `/etc/caddy/Caddyfile`
(before `code.halkyon.app {`) and its site at the end, and check it:
(before `code.halkyon.app {`) and its sites at the end, and check it; 8443 must stay
closed from outside (ufw's default for incoming: deny):
```sh
sudo ufw status verbose | grep -E 'Default|8443' # deny (incoming), no 8443 rule
sudo cp /etc/caddy/Caddyfile /etc/caddy/Caddyfile.before-haproxy
sudoedit /etc/caddy/Caddyfile
sudo caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
@ -88,6 +90,7 @@ alongside (`../host/README.md`): each side needs the other's public key.
sudo systemctl reload caddy && sudo systemctl restart haproxy
sudo ss -tlnp | grep -E ':(443|8443) ' # haproxy on 443, caddy on 8443
curl -sI https://code.halkyon.app | head -1 # from melchior: HTTP/2 200
curl -sI http://code.halkyon.app | grep -i '^location' # https://code.halkyon.app/, no :8443
```
If anything fails, step 8 is undone by `sudo systemctl stop haproxy`, the old