Tizian 「ティツィアーン」
fb6b78fa19
The apps' half of ADR 0044's step 5 (D37 to D40), on the instance's
half of the commit before.
halkyon_app's SharedSpaceGateway asks for inviting by mail, the
preview of a link, the code proving an address, accepting a mailed
invitation, a space's link (read, switched, joined) and marking a
share seen; SpaceInfo says whether a share is new and who made it,
a member whether they were invited by mail. joinTokenOf reads a link
or its token as pasted. The fake keeps the mails and codes it would
send, for the apps' tests.
In Learn:
- the Owner's Share sheet invites by handle or by email, lists an
invitation mailed by its role alone, and switches the space's link,
copying it while on;
- the Library's menu has Join with a link, and a link opened on
Android (/join/<token> on learn.halkyon.eu, verified through the
instance's assetlinks) opens the same on a screen of its own: who
invites and as whom, then Join, or for a mailed invitation the
address and the code mailed there;
- a studyset someone shared is new until opened: in the Inbox
("@alice shared Japanese with you", Open or Leave), on the Profile
tab's badge and as New on its library card (NewSharesCubit, read
again after every merge).
Whats-New: Invite people to a shared studyset by email or with a link, join one from the Library's Join with a link, and see in the Inbox what was shared with you.
Whats-New-De: Lade Leute per E-Mail oder Link zu einem geteilten Lernset ein, tritt einem über „Mit einem Link beitreten“ in der Bibliothek bei und sieh im Posteingang, was mit dir geteilt wurde.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
89 lines
3.8 KiB
Caddyfile
89 lines
3.8 KiB
Caddyfile
# Caddy forwards to the API server, and profile pages (ADR 0011), the dictionaries
|
|
# devices download (ADR 0012), SimpleLogin's forwarding page (ADR 0020), the
|
|
# privacy page (ADR 0021) and the pages of links to join (Halkyon's ADR 0044) to the web server (8082), which serves nothing else. Never the calls between the instance's
|
|
# services (`/halkyon-base/…`, ADR 0016): they reach each other on its own network. Insights (8081) doesn't run in production;
|
|
# if it is ever re-enabled, reach it through an SSH tunnel, never through this file.
|
|
#
|
|
# {$LEARN_DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
|
|
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
|
|
# {$ACCOUNT_SITE} is the account domain handles are on where it isn't {$LEARN_DOMAIN}
|
|
# (`halkyon.eu`), whose profile pages this instance serves; empty for none.
|
|
# Global options an instance's setting adds (compose.forwarded.yaml: behind another
|
|
# server's HAProxy, ADR 0039); none without.
|
|
{
|
|
import global/*.caddy
|
|
}
|
|
|
|
{$LEARN_DOMAIN} {$ACCOUNT_SITE} {
|
|
encode zstd gzip
|
|
|
|
# Profile pages, `/@handle`; asked for on the other host, they send the visitor to
|
|
# their own address.
|
|
@profile path /@*
|
|
handle @profile {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# The account domain serves profile pages alone. (An expression: a host matcher of
|
|
# an empty variable would match every host.)
|
|
@account expression `{host} == "{$ACCOUNT_SITE}"`
|
|
handle @account {
|
|
respond 404
|
|
}
|
|
|
|
# The instance's privacy page (Halkyon Learn's ADR 0021, D39), made from its
|
|
# settings, readable before signing up.
|
|
@privacy path /privacy
|
|
handle @privacy {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# The pages of links to join a shared studyset (Halkyon's ADR 0044, D39), which
|
|
# the app opens itself on Android where it may.
|
|
@join path /join/*
|
|
handle @join {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# SimpleLogin's forwarding page (ADR 0020): where SimpleLogin sends a sign-in back,
|
|
# which sends it on to the app that began it, by the loopback or its scheme.
|
|
@simplelogin path /simplelogin-callback
|
|
handle @simplelogin {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# Android's statement that Halkyon Learn, signed with the project's key
|
|
# (tool/release/android-certificate.sha256), may open learn.halkyon.eu's links
|
|
# itself (App Links): built for ADR 0020's D9, whose correction brings the
|
|
# sign-in back through the app's scheme instead, and used since by the links to
|
|
# join a shared studyset (Halkyon's ADR 0044, D39). On learn.halkyon.eu alone, the one instance the
|
|
# project's builds name: another operator's domain is no link of the project's
|
|
# app. Written here rather than by the server, which knows no app's key.
|
|
@assetlinks {
|
|
host learn.halkyon.eu
|
|
path /.well-known/assetlinks.json
|
|
}
|
|
handle @assetlinks {
|
|
header Content-Type application/json
|
|
respond `[{"relation":["delegate_permission/common.handle_all_urls"],"target":{"namespace":"android_app","package_name":"app.halkyon.learn","sha256_cert_fingerprints":["27:E2:43:FC:BD:C8:26:FF:98:AB:7D:BB:10:43:6C:98:C3:BE:A2:4B:2A:01:5E:94:E4:CF:C7:D1:FC:2A:00:6C"]}}]` 200
|
|
}
|
|
|
|
# The dictionaries devices download to look Japanese up by themselves, named by
|
|
# their hashes; already compressed.
|
|
handle /device-dictionaries/* {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
|
|
# Caddy puts the visitor's address last in X-Forwarded-For (what a visitor sends
|
|
# there it replaces), which the server's per-network limits count by, as
|
|
# TRUSTED_PROXIES names Caddy (compose.learn.yaml); the server never reads the Forwarded
|
|
# header, which Caddy passes on as sent.
|
|
handle {
|
|
reverse_proxy server:8080
|
|
}
|
|
}
|
|
|
|
# The sites of the sidecars switched on (sidecars/README.md), which their compose files
|
|
# mount into sidecars/; none without.
|
|
import sidecars/*.caddy
|