Tizian 「ティツィアーン」
d9039d36ef
Every per-network limit counted by the connection's address, which behind Caddy is Caddy's for everyone: new anonymous accounts, codes by mail and password sign-ins were each limited for the whole instance. `networkOf` (now `common/network.dart`) takes the last address of X-Forwarded-For, the one the proxy saw itself, for a connection from a proxy the operator trusts (`TRUSTED_PROXIES`, which deploy/compose.yaml sets to Caddy's fixed address); otherwise, or where that is no address, the connection's. Never the Forwarded header, which Caddy passes on as sent, so never Serverpod's `remoteInfo`. A value that isn't addresses stops the server as it starts. Serverpod's own limit on anonymous accounts counts by the connection's address too and can't be told otherwise, so it is off; the anonymous endpoint counts them itself, 30 an hour per network as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
52 lines
2.2 KiB
Caddyfile
52 lines
2.2 KiB
Caddyfile
# Caddy forwards to the API server, and the assistant connector's paths (ADR 0006),
|
|
# profile pages (ADR 0011) and the dictionaries devices download (ADR 0012) to the web
|
|
# server (8082), which serves nothing else. Never the calls between the instance's
|
|
# services (`/halkyon-base/…`, ADR 0016): they reach each other on its own network. Insights (8081) doesn't run in production;
|
|
# if it is ever re-enabled, reach it through an SSH tunnel, never through this file.
|
|
#
|
|
# {$DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
|
|
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
|
|
# {$ACCOUNT_SITE} is the account domain handles are on where it isn't {$DOMAIN}
|
|
# (`halkyon.eu`), whose profile pages this instance serves; empty for none.
|
|
{$DOMAIN} {$ACCOUNT_SITE} {
|
|
encode zstd gzip
|
|
|
|
# Profile pages, `/@handle`; asked for on the other host, they send the visitor to
|
|
# their own address.
|
|
@profile path /@*
|
|
handle @profile {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# The account domain serves profile pages alone. (An expression: a host matcher of
|
|
# an empty variable would match every host.)
|
|
@account expression `{host} == "{$ACCOUNT_SITE}"`
|
|
handle @account {
|
|
respond 404
|
|
}
|
|
|
|
# The assistant connector: the MCP endpoint, its OAuth pages, and their metadata.
|
|
@connector path /mcp /oauth/* /.well-known/oauth-protected-resource /.well-known/oauth-protected-resource/* /.well-known/oauth-authorization-server
|
|
handle @connector {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# The dictionaries devices download to look Japanese up by themselves, named by
|
|
# their hashes; already compressed.
|
|
handle /device-dictionaries/* {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
|
|
# Caddy puts the visitor's address last in X-Forwarded-For (what a visitor sends
|
|
# there it replaces), which the server's per-network limits count by, as
|
|
# TRUSTED_PROXIES names Caddy (compose.yaml); the server never reads the Forwarded
|
|
# header, which Caddy passes on as sent.
|
|
handle {
|
|
reverse_proxy server:8080
|
|
}
|
|
}
|
|
|
|
# The sites of the sidecars switched on (sidecars/README.md), which their compose files
|
|
# mount into sidecars/; none without.
|
|
import sidecars/*.caddy
|