fix(deploy): ramiel's own names redirected to HTTPS by hand behind HAProxy (ADR 0039)

With https_port 8443, Caddy's automatic HTTP-to-HTTPS redirects would send
visitors of code.halkyon.app, halkyon.app and learn.halkyon.app to :8443,
which is closed from outside. A site of their own on http:// redirects them
to the default port instead. The README's step for home's key points at the
host's step 5, and checks that 8443 stays closed and the redirect carries no
port.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/forward/Caddyfile.halkyon-li

@@ -25,7 +25,15 @@
 	}
 }
 
-# --- a site: the end of /etc/caddy/Caddyfile ---
+# --- sites: the end of /etc/caddy/Caddyfile ---
+# ramiel's own names over plain HTTP, sent on to HTTPS by hand: with https_port 8443,
+# Caddy's automatic redirects would send people to :8443, which is closed from outside.
+# A site of its own on http:// takes a name's automatic redirect away; certificates are
+# still issued on port 80 as before.
+http://code.halkyon.app, http://halkyon.app, http://learn.halkyon.app {
+	redir https://{host}{uri} 308
+}
+
 # halkyon.li over plain HTTP, sent on to HTTPS, which HAProxy passes home; nothing of
 # halkyon.li is served or certified here.
 http://halkyon.li, http://*.halkyon.li {

deploy/forward/README.md

@@ -46,7 +46,7 @@ alongside (`../host/README.md`): each side needs the other's public key.
    sudo wg pubkey < /etc/wireguard/wg-halkyon.key   # ramiel's public key: home's config
    ```
 
-4. **The tunnel's files**, with home's public key (from `../host/README.md`, step 4) in
+4. **The tunnel's files**, with home's public key (from `../host/README.md`, step 5) in
    place of `<home's public key>`:
 
    ```sh
@@ -71,9 +71,11 @@ alongside (`../host/README.md`): each side needs the other's public key.
 
 7. **Caddy moved behind HAProxy.** Keep the Caddyfile as it is, then put
    `Caddyfile.halkyon-li`'s global options at the very top of `/etc/caddy/Caddyfile`
-   (before `code.halkyon.app {`) and its site at the end, and check it:
+   (before `code.halkyon.app {`) and its sites at the end, and check it; 8443 must stay
+   closed from outside (ufw's default for incoming: deny):
 
    ```sh
+   sudo ufw status verbose | grep -E 'Default|8443'   # deny (incoming), no 8443 rule
    sudo cp /etc/caddy/Caddyfile /etc/caddy/Caddyfile.before-haproxy
    sudoedit /etc/caddy/Caddyfile
    sudo caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
@@ -88,6 +90,7 @@ alongside (`../host/README.md`): each side needs the other's public key.
    sudo systemctl reload caddy && sudo systemctl restart haproxy
    sudo ss -tlnp | grep -E ':(443|8443) '   # haproxy on 443, caddy on 8443
    curl -sI https://code.halkyon.app | head -1   # from melchior: HTTP/2 200
+   curl -sI http://code.halkyon.app | grep -i '^location'   # https://code.halkyon.app/, no :8443
    ```
 
    If anything fails, step 8 is undone by `sudo systemctl stop haproxy`, the old

test/deploy/halkyon_li_forward_test.dart

@@ -87,6 +87,24 @@ void main() {
       expect(caddy, contains('redir https://{host}{uri} 308'));
       expect(caddy, isNot(contains('reverse_proxy')));
     });
+
+    test("redirects its own names to HTTPS by hand, so Caddy's automatic "
+        'redirects never point at 8443', () {
+      expect(
+        caddy,
+        contains(
+          'http://code.halkyon.app, http://halkyon.app, '
+          'http://learn.halkyon.app {',
+        ),
+      );
+      expect(
+        RegExp(
+          r'^\s*redir (\S+)',
+          multiLine: true,
+        ).allMatches(caddy).map((match) => match[1]),
+        everyElement('https://{host}{uri}'),
+      );
+    });
   });
 
   group("ramiel's end of the tunnel (D8, D9)", () {