Tizian 「ティツィアーン」
29844c7fa6
ramiel's HAProxy passes halkyon.li's TLS connections, unopened, through a WireGuard tunnel to the instance at home, with the visitor's address in a PROXY header, and everything else to ramiel's own Caddy, moved to the loopback. Each end's nftables table lets the tunnel carry HAProxy's 443 and the SSH jump's 22 alone, and nothing from home to ramiel. The host at home: sshd with keys alone, the root disk unlocked over SSH at boot (dropbear-initramfs, D20), Docker's and containerd's data bind-mounted from the HDD, and home's end of the tunnel before Docker. An instance behind the forward (compose.forwarded.yaml) publishes 443 on the tunnel's address alone, trusts the PROXY header from ramiel alone, and gets its certificates through TLS-ALPN, without HTTP/3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
33 lines
1.1 KiB
Text
33 lines
1.1 KiB
Text
# What ramiel's Caddy (/etc/caddy/Caddyfile) gains for HAProxy in front of it (ADR 0039,
|
|
# D3, D10, D11). Not a Caddyfile of its own: the global options below go at the very
|
|
# top of ramiel's, before `code.halkyon.app {`, and the site at its end. Setting it up:
|
|
# forward/README.md.
|
|
|
|
# --- global options: the top of /etc/caddy/Caddyfile ---
|
|
{
|
|
# HAProxy holds 443 and hands Caddy what isn't halkyon.li's on 8443, which ufw
|
|
# keeps closed from outside. Port 80 stays Caddy's.
|
|
https_port 8443
|
|
servers :8443 {
|
|
listener_wrappers {
|
|
# The visitor's address from HAProxy's PROXY header, trusted from the
|
|
# loopback alone, so the forge's log keeps visitors rather than
|
|
# 127.0.0.1.
|
|
proxy_protocol {
|
|
timeout 5s
|
|
allow 127.0.0.1/32 ::1/128
|
|
}
|
|
tls
|
|
}
|
|
# HTTP/3 runs over UDP, which HAProxy doesn't route: none, so no client is
|
|
# sent to look for it.
|
|
protocols h1 h2
|
|
}
|
|
}
|
|
|
|
# --- a site: the end of /etc/caddy/Caddyfile ---
|
|
# halkyon.li over plain HTTP, sent on to HTTPS, which HAProxy passes home; nothing of
|
|
# halkyon.li is served or certified here.
|
|
http://halkyon.li, http://*.halkyon.li {
|
|
redir https://{host}{uri} 308
|
|
}
|