Tizian 「ティツィアーン」
fb5eda87e9
With https_port 8443, Caddy's automatic HTTP-to-HTTPS redirects would send visitors of code.halkyon.app, halkyon.app and learn.halkyon.app to :8443, which is closed from outside. A site of their own on http:// redirects them to the default port instead. The README's step for home's key points at the host's step 5, and checks that 8443 stays closed and the redirect carries no port. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
41 lines
1.5 KiB
Text
41 lines
1.5 KiB
Text
# What ramiel's Caddy (/etc/caddy/Caddyfile) gains for HAProxy in front of it (ADR 0039,
|
|
# D3, D10, D11). Not a Caddyfile of its own: the global options below go at the very
|
|
# top of ramiel's, before `code.halkyon.app {`, and the site at its end. Setting it up:
|
|
# forward/README.md.
|
|
|
|
# --- global options: the top of /etc/caddy/Caddyfile ---
|
|
{
|
|
# HAProxy holds 443 and hands Caddy what isn't halkyon.li's on 8443, which ufw
|
|
# keeps closed from outside. Port 80 stays Caddy's.
|
|
https_port 8443
|
|
servers :8443 {
|
|
listener_wrappers {
|
|
# The visitor's address from HAProxy's PROXY header, trusted from the
|
|
# loopback alone, so the forge's log keeps visitors rather than
|
|
# 127.0.0.1.
|
|
proxy_protocol {
|
|
timeout 5s
|
|
allow 127.0.0.1/32 ::1/128
|
|
}
|
|
tls
|
|
}
|
|
# HTTP/3 runs over UDP, which HAProxy doesn't route: none, so no client is
|
|
# sent to look for it.
|
|
protocols h1 h2
|
|
}
|
|
}
|
|
|
|
# --- sites: the end of /etc/caddy/Caddyfile ---
|
|
# ramiel's own names over plain HTTP, sent on to HTTPS by hand: with https_port 8443,
|
|
# Caddy's automatic redirects would send people to :8443, which is closed from outside.
|
|
# A site of its own on http:// takes a name's automatic redirect away; certificates are
|
|
# still issued on port 80 as before.
|
|
http://code.halkyon.app, http://halkyon.app, http://learn.halkyon.app {
|
|
redir https://{host}{uri} 308
|
|
}
|
|
|
|
# halkyon.li over plain HTTP, sent on to HTTPS, which HAProxy passes home; nothing of
|
|
# halkyon.li is served or certified here.
|
|
http://halkyon.li, http://*.halkyon.li {
|
|
redir https://{host}{uri} 308
|
|
}
|