Tizian 「ティツィアーン」
93b0c0a6b0
Files called the servers by their own host names, which are the operator's and say nothing a reader needs. They now say which domain a server serves: learn.halkyon.eu's server (the instance and its CI runner), the halkyon.app server (Forgejo and the F-Droid repository). Two names are settings rather than words. CI's runner label becomes `instance` (`runs-on: instance`, `labels: ["instance:host"]`): the runner reads its installed copy of deploy/runner/config.yml, so jobs wait in the queue until that copy is updated and the runner restarted. The SSH aliases the scripts and docs use become `learn-deploy` and `fdroid-upload`. AGENTS.md says to keep it so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
21 lines
882 B
Caddyfile
21 lines
882 B
Caddyfile
# Caddy forwards to the API server, and the assistant connector's paths (ADR 0006) to
|
|
# the web server (8082), which serves nothing else. Insights (8081) doesn't run in
|
|
# production; if it is ever re-enabled, reach it through an SSH tunnel, never through
|
|
# this file.
|
|
#
|
|
# {$DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
|
|
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
|
|
{$DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
# The assistant connector: the MCP endpoint, its OAuth pages, and their metadata.
|
|
@connector path /mcp /oauth/* /.well-known/oauth-protected-resource /.well-known/oauth-protected-resource/* /.well-known/oauth-authorization-server
|
|
handle @connector {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
|
|
handle {
|
|
reverse_proxy server:8080
|
|
}
|
|
}
|