78 lines
2.7 KiB
Caddyfile
78 lines
2.7 KiB
Caddyfile
# Caddy fronts the whole Hephaestus stack.
|
|
#
|
|
# TWO HOSTNAMES:
|
|
# code.silentmode.st Traditional DNS + Let's Encrypt HTTP-01 cert. Same as before.
|
|
# hephaestus.x BCNR name (chipnet). TLS cert issued by Silent Mode's own
|
|
# root CA (Argonautica) — trusted by Theseus/Ariadne users;
|
|
# other browsers see a self-signed-style warning. hephaestus.x
|
|
# also serves static content from /srv/hephaestus.x/* (the
|
|
# landing pages) BEFORE falling through to Forgejo, so
|
|
# marketing/docs pages don't get eaten by Forgejo's routes.
|
|
#
|
|
# ROUTING (both hostnames):
|
|
# /auth/* → auth-proxy container (prefix stripped)
|
|
# / → Forgejo container (with per-hostname behaviour below)
|
|
#
|
|
# {$SITE_HOSTNAME} comes from docker-compose .env (SITE_HOSTNAME=code.silentmode.st).
|
|
|
|
# --- code.silentmode.st: unchanged from before ---
|
|
{$SITE_HOSTNAME} {
|
|
encode gzip zstd
|
|
|
|
handle_path /auth/* {
|
|
reverse_proxy auth-proxy:4000
|
|
}
|
|
|
|
# Make BCH-wallet login the DEFAULT for /user/login. Old-school
|
|
# username/password stays reachable via `/user/login?password=1`
|
|
# (unmatched by this rule; falls through to Forgejo).
|
|
@plain_login {
|
|
path /user/login
|
|
not query password=1
|
|
}
|
|
redir @plain_login /user/oauth2/hephaestus-wallet 302
|
|
|
|
handle {
|
|
reverse_proxy forgejo:3000
|
|
request_body {
|
|
max_size 2GB
|
|
}
|
|
}
|
|
}
|
|
|
|
# --- hephaestus.x: static-first, Forgejo-fallback, Silent Mode CA cert ---
|
|
hephaestus.x {
|
|
encode gzip zstd
|
|
|
|
# TLS cert from Silent Mode's Argonautica CA (name-constrained to permitted TLDs).
|
|
# Theseus + Ariadne users have this CA in their trust store per the setup docs.
|
|
tls /etc/caddy/certs/hephaestus.x.crt /etc/caddy/certs/hephaestus.x.key
|
|
|
|
handle_path /auth/* {
|
|
reverse_proxy auth-proxy:4000
|
|
}
|
|
|
|
# Same wallet-login-as-default as code.silentmode.st. Old-school
|
|
# password login still reachable via /user/login?password=1.
|
|
@plain_login {
|
|
path /user/login
|
|
not query password=1
|
|
}
|
|
redir @plain_login /user/oauth2/hephaestus-wallet 302
|
|
|
|
# Static-file-first, Forgejo-fallback. If /srv/hephaestus.x/{path} (or {path}/index.html)
|
|
# exists, serve it. Otherwise the request falls through to Forgejo so all git/api/user
|
|
# routes still work.
|
|
root * /srv/hephaestus.x
|
|
@static file {path} {path}index.html {path}/index.html
|
|
handle @static {
|
|
try_files {path} {path}index.html {path}/index.html
|
|
file_server
|
|
}
|
|
handle {
|
|
reverse_proxy forgejo:3000
|
|
request_body {
|
|
max_size 2GB
|
|
}
|
|
}
|
|
}
|