Tizian 「ティツィアーン」
7ea9f16904
simpleLogin.begin takes the way back (SimpleLoginReturn: loopback, scheme) rather than the platform, so macOS can come back through its scheme as iOS and Android do; the markers become learn-loopback, learn-scheme, todo-loopback and todo-scheme. Not breaking: the endpoint has never been released. D9 corrected by the developer after research: Android, iOS and macOS come back through the app's scheme, Linux and Windows through the loopback. Verified links protected nothing here: a code caught on its way is worthless without the attempt's ID, and a hostile app beginning an attempt of its own can ask for a way back that other platforms need open. The ADR notes the residual risk and the check of prompt=consent still to do. assetlinks.json stays served. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
69 lines
3.1 KiB
Caddyfile
69 lines
3.1 KiB
Caddyfile
# Caddy forwards to the API server, and profile pages (ADR 0011), the dictionaries
|
|
# devices download (ADR 0012) and SimpleLogin's forwarding page (ADR 0020) to the web
|
|
# server (8082), which serves nothing else. Never the calls between the instance's
|
|
# services (`/halkyon-base/…`, ADR 0016): they reach each other on its own network. Insights (8081) doesn't run in production;
|
|
# if it is ever re-enabled, reach it through an SSH tunnel, never through this file.
|
|
#
|
|
# {$DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
|
|
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
|
|
# {$ACCOUNT_SITE} is the account domain handles are on where it isn't {$DOMAIN}
|
|
# (`halkyon.eu`), whose profile pages this instance serves; empty for none.
|
|
{$DOMAIN} {$ACCOUNT_SITE} {
|
|
encode zstd gzip
|
|
|
|
# Profile pages, `/@handle`; asked for on the other host, they send the visitor to
|
|
# their own address.
|
|
@profile path /@*
|
|
handle @profile {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# The account domain serves profile pages alone. (An expression: a host matcher of
|
|
# an empty variable would match every host.)
|
|
@account expression `{host} == "{$ACCOUNT_SITE}"`
|
|
handle @account {
|
|
respond 404
|
|
}
|
|
|
|
# SimpleLogin's forwarding page (ADR 0020): where SimpleLogin sends a sign-in back,
|
|
# which sends it on to the app that began it, by the loopback or its scheme.
|
|
@simplelogin path /simplelogin-callback
|
|
handle @simplelogin {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# Android's statement that Halkyon Learn, signed with the project's key
|
|
# (tool/release/android-certificate.sha256), may open learn.halkyon.eu's links
|
|
# itself (App Links): built for ADR 0020's D9, whose correction brings the
|
|
# sign-in back through the app's scheme instead, and kept, as it costs
|
|
# nothing. On learn.halkyon.eu alone, the one instance the
|
|
# project's builds name: another operator's domain is no link of the project's
|
|
# app. Written here rather than by the server, which knows no app's key.
|
|
@assetlinks {
|
|
host learn.halkyon.eu
|
|
path /.well-known/assetlinks.json
|
|
}
|
|
handle @assetlinks {
|
|
header Content-Type application/json
|
|
respond `[{"relation":["delegate_permission/common.handle_all_urls"],"target":{"namespace":"android_app","package_name":"app.halkyon.learn","sha256_cert_fingerprints":["27:E2:43:FC:BD:C8:26:FF:98:AB:7D:BB:10:43:6C:98:C3:BE:A2:4B:2A:01:5E:94:E4:CF:C7:D1:FC:2A:00:6C"]}}]` 200
|
|
}
|
|
|
|
# The dictionaries devices download to look Japanese up by themselves, named by
|
|
# their hashes; already compressed.
|
|
handle /device-dictionaries/* {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
|
|
# Caddy puts the visitor's address last in X-Forwarded-For (what a visitor sends
|
|
# there it replaces), which the server's per-network limits count by, as
|
|
# TRUSTED_PROXIES names Caddy (compose.yaml); the server never reads the Forwarded
|
|
# header, which Caddy passes on as sent.
|
|
handle {
|
|
reverse_proxy server:8080
|
|
}
|
|
}
|
|
|
|
# The sites of the sidecars switched on (sidecars/README.md), which their compose files
|
|
# mount into sidecars/; none without.
|
|
import sidecars/*.caddy
|