Tizian 「ティツィアーン」
29844c7fa6
ramiel's HAProxy passes halkyon.li's TLS connections, unopened, through a WireGuard tunnel to the instance at home, with the visitor's address in a PROXY header, and everything else to ramiel's own Caddy, moved to the loopback. Each end's nftables table lets the tunnel carry HAProxy's 443 and the SSH jump's 22 alone, and nothing from home to ramiel. The host at home: sshd with keys alone, the root disk unlocked over SSH at boot (dropbear-initramfs, D20), Docker's and containerd's data bind-mounted from the HDD, and home's end of the tunnel before Docker. An instance behind the forward (compose.forwarded.yaml) publishes 443 on the tunnel's address alone, trusts the PROXY header from ramiel alone, and gets its certificates through TLS-ALPN, without HTTP/3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
25 lines
862 B
Text
25 lines
862 B
Text
# Caddy's global options for an instance behind HAProxy (ADR 0039, D10, D11), which
|
|
# compose.forwarded.yaml mounts into /etc/caddy/global/ and the Caddyfile's global
|
|
# options import.
|
|
|
|
servers {
|
|
listener_wrappers {
|
|
# The visitor's address from HAProxy's PROXY header, trusted from ramiel's
|
|
# tunnel address alone (where Docker hands its connections on unchanged),
|
|
# so the servers' per-network limits count visitors, not ramiel.
|
|
proxy_protocol {
|
|
timeout 5s
|
|
allow 10.61.97.1/32
|
|
}
|
|
tls
|
|
}
|
|
# HTTP/3 runs over UDP, which HAProxy doesn't route: none, so no client is sent
|
|
# looking for it at ramiel, whose UDP 443 is its own Caddy's.
|
|
protocols h1 h2
|
|
}
|
|
|
|
# Certificates through the TLS-ALPN challenge alone, which reaches here through
|
|
# HAProxy unopened; port 80 isn't published, as ramiel answers it.
|
|
cert_issuer acme {
|
|
disable_http_challenge
|
|
}
|