8d9b3a8a7a
Architecture shift: hephaestus.x used to be Sia-bucket-only (via bns-gateway's
s3: record type). Now it's VPS-served with Silent Mode CA cert; the Sia bucket
stays populated as a disaster-recovery mirror that a single Argus CLI call
(update.js flipping ip: → s3:) can promote back to primary if the VPS dies.
Every code.silentmode.st URL now also works at hephaestus.x — the same Caddy
handles both hostnames; hephaestus.x additionally checks /srv/hephaestus.x/
for a matching static file first, so /forge/, /silentmode/theseus/, and the
other landing pages don't get eaten by Forgejo's dynamic routes.
- caddy/Caddyfile: add hephaestus.x server block with the Argonautica-issued
cert; static-first, Forgejo-fallback
- docker-compose.yml: mount ./caddy (whole dir, for certs/) and
/var/www/hephaestus.x → /srv/hephaestus.x
- scripts/sync-hephaestus-x-to-sia.sh: nightly rclone sync as DR backup
Off-tree changes (kept in memory record for future sessions):
- Silent Mode CA issued hephaestus.x.crt (fingerprint
6e251c2bb4987e66890aa28ebc8e16df5dfe03c1fc559634246ae69c2e00400b)
- BCNR record on hephaestus.x flipped to {"ip":"81.31.210.65","tls":"6e251c2b..."}
(TXID fdd301a2ae313636f71ec4dfba9a3ff723a9158b4a3937ac4ce0a83b3f8cda11)
- systemd timer hephaestus-x-sia-sync.timer on the p2pexchange VPS, 03:35 UTC daily
61 lines
2.1 KiB
Caddyfile
61 lines
2.1 KiB
Caddyfile
# Caddy fronts the whole Hephaestus stack.
|
|
#
|
|
# TWO HOSTNAMES:
|
|
# code.silentmode.st Traditional DNS + Let's Encrypt HTTP-01 cert. Same as before.
|
|
# hephaestus.x BCNR name (chipnet). TLS cert issued by Silent Mode's own
|
|
# root CA (Argonautica) — trusted by Theseus/Ariadne users;
|
|
# other browsers see a self-signed-style warning. hephaestus.x
|
|
# also serves static content from /srv/hephaestus.x/* (the
|
|
# landing pages) BEFORE falling through to Forgejo, so
|
|
# marketing/docs pages don't get eaten by Forgejo's routes.
|
|
#
|
|
# ROUTING (both hostnames):
|
|
# /auth/* → auth-proxy container (prefix stripped)
|
|
# / → Forgejo container (with per-hostname behaviour below)
|
|
#
|
|
# {$SITE_HOSTNAME} comes from docker-compose .env (SITE_HOSTNAME=code.silentmode.st).
|
|
|
|
# --- code.silentmode.st: unchanged from before ---
|
|
{$SITE_HOSTNAME} {
|
|
encode gzip zstd
|
|
|
|
handle_path /auth/* {
|
|
reverse_proxy auth-proxy:4000
|
|
}
|
|
|
|
handle {
|
|
reverse_proxy forgejo:3000
|
|
request_body {
|
|
max_size 2GB
|
|
}
|
|
}
|
|
}
|
|
|
|
# --- hephaestus.x: static-first, Forgejo-fallback, Silent Mode CA cert ---
|
|
hephaestus.x {
|
|
encode gzip zstd
|
|
|
|
# TLS cert from Silent Mode's Argonautica CA (name-constrained to permitted TLDs).
|
|
# Theseus + Ariadne users have this CA in their trust store per the setup docs.
|
|
tls /etc/caddy/certs/hephaestus.x.crt /etc/caddy/certs/hephaestus.x.key
|
|
|
|
handle_path /auth/* {
|
|
reverse_proxy auth-proxy:4000
|
|
}
|
|
|
|
# Static-file-first, Forgejo-fallback. If /srv/hephaestus.x/{path} (or {path}/index.html)
|
|
# exists, serve it. Otherwise the request falls through to Forgejo so all git/api/user
|
|
# routes still work.
|
|
root * /srv/hephaestus.x
|
|
@static file {path} {path}index.html {path}/index.html
|
|
handle @static {
|
|
try_files {path} {path}index.html {path}/index.html
|
|
file_server
|
|
}
|
|
handle {
|
|
reverse_proxy forgejo:3000
|
|
request_body {
|
|
max_size 2GB
|
|
}
|
|
}
|
|
}
|