ops: paivana and caddy config refresh
This commit is contained in:
Hernâni Marques
parent
d8dbc6242b
commit
56f814a6de
74 changed files with 4517 additions and 79 deletions
399
configs/caddy/Caddyfile.bak-caddy-apply-20260908-090955
Normal file
399
configs/caddy/Caddyfile.bak-caddy-apply-20260908-090955
Normal file
|
|
@ -0,0 +1,399 @@
|
|||
# Internal only (not in the browser URL):
|
||||
# 9010 merchant API | 9011 exchange API | 9012 bank API
|
||||
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
|
||||
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9029 galene | 9030 cryptpad | 9031 meet | 9200 forgejo-ssh
|
||||
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
|
||||
|
||||
{
|
||||
email info+koopa@hacktivism.ch
|
||||
http_port 9000
|
||||
https_port 9001
|
||||
auto_https disable_redirects
|
||||
# Caddy listens on 9001 behind VeciGate/https-proxy :443.
|
||||
# Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
|
||||
servers {
|
||||
protocols h1 h2
|
||||
}
|
||||
}
|
||||
|
||||
(proxy_public) {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
header_up X-Forwarded-Port 443
|
||||
header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
|
||||
}
|
||||
|
||||
taler.hacktivism.ch {
|
||||
tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9015 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# surface + aptdeploy HTML (taler.hacktivism.ch only)
|
||||
handle /taler-monitoring-surface_err {
|
||||
redir /taler-monitoring-surface_err/ 302
|
||||
}
|
||||
handle /taler-monitoring-surface_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-surface {
|
||||
redir /taler-monitoring-surface/ 302
|
||||
}
|
||||
handle /taler-monitoring-surface* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-aptdeploy_err {
|
||||
redir /taler-monitoring-aptdeploy_err/ 302
|
||||
}
|
||||
handle /taler-monitoring-aptdeploy_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-aptdeploy {
|
||||
redir /taler-monitoring-aptdeploy/ 302
|
||||
}
|
||||
handle /taler-monitoring-aptdeploy* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
handle /taler-monitoring-mattermost_err {
|
||||
redir /taler-monitoring-mattermost_err/ 302
|
||||
}
|
||||
handle /taler-monitoring-mattermost_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-mattermost {
|
||||
redir /taler-monitoring-mattermost/ 302
|
||||
}
|
||||
handle /taler-monitoring-mattermost* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
handle /taler-monitoring-mail_err {
|
||||
redir /taler-monitoring-mail_err/ 302
|
||||
}
|
||||
handle /taler-monitoring-mail_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /taler-monitoring-mail {
|
||||
redir /taler-monitoring-mail/ 302
|
||||
}
|
||||
handle /taler-monitoring-mail* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
# taler-monitoring console HTML (host static — not in app containers)
|
||||
handle /monitoring_err {
|
||||
redir /monitoring_err/ 302
|
||||
}
|
||||
handle /monitoring_err* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /monitoring {
|
||||
redir /monitoring/ 302
|
||||
}
|
||||
handle /monitoring* {
|
||||
root * /var/www/monitoring-sites/taler.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
# SPA: /webui → /webui/
|
||||
redir /webui /webui/ 302
|
||||
|
||||
# Merchant API + WebUI (nginx :9010 → unix socket)
|
||||
reverse_proxy https://127.0.0.1:9010 {
|
||||
transport http {
|
||||
tls_insecure_skip_verify
|
||||
}
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
exchange.hacktivism.ch {
|
||||
tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9014 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# taler-monitoring console HTML (host static — not in app containers)
|
||||
handle /monitoring_err {
|
||||
redir /monitoring_err/ 302
|
||||
}
|
||||
handle /monitoring_err* {
|
||||
root * /var/www/monitoring-sites/exchange.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /monitoring {
|
||||
redir /monitoring/ 302
|
||||
}
|
||||
handle /monitoring* {
|
||||
root * /var/www/monitoring-sites/exchange.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
|
||||
reverse_proxy 127.0.0.1:9011 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
bank.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# taler-monitoring console HTML (host static — not in app containers)
|
||||
handle /monitoring_err {
|
||||
redir /monitoring_err/ 302
|
||||
}
|
||||
handle /monitoring_err* {
|
||||
root * /var/www/monitoring-sites/bank.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
handle /monitoring {
|
||||
redir /monitoring/ 302
|
||||
}
|
||||
handle /monitoring* {
|
||||
root * /var/www/monitoring-sites/bank.hacktivism.ch
|
||||
file_server
|
||||
}
|
||||
|
||||
|
||||
# Static terms/privacy on landing nginx :9013
|
||||
handle /terms* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
handle /privacy* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:9012 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
castopod.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9020 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
}
|
||||
}
|
||||
|
||||
bonfire.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9021 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
flush_interval -1
|
||||
}
|
||||
}
|
||||
|
||||
prime.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9022 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
flush_interval -1
|
||||
}
|
||||
}
|
||||
|
||||
bt.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9023 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
}
|
||||
}
|
||||
|
||||
# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
|
||||
git.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9024 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# Taler Operations design previews (static nginx)
|
||||
tops.ng1.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9090 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
}
|
||||
}
|
||||
|
||||
tops.ng2.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9091 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
}
|
||||
}
|
||||
|
||||
tops.ng3.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9092 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# 9025 paivana-httpd (GOA paywall)
|
||||
paivana.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9025 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
header_up X-Forwarded-Port 443
|
||||
}
|
||||
}
|
||||
|
||||
# 9026 lemmy (+ ui/pictrs via internal nginx)
|
||||
lemmy.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9026 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# 9027 decidim (rails)
|
||||
decidim.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9027 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
header_up X-Forwarded-Port 443
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# 9029 galene — allocated 2026-09-08
|
||||
# Merge: scripts/caddy/caddy-apply.sh --site galene.hacktivism.ch --port 9029 --label galene
|
||||
galene.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9029 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
header_up X-Forwarded-Port 443
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# 9030 cryptpad — allocated 2026-09-08
|
||||
# Merge: scripts/caddy/caddy-apply.sh --site cryptpad.hacktivism.ch --port 9030 --label cryptpad
|
||||
# CryptPad also needs sandbox subdomain (cryptpad-ui / sandbox) — wire after first boot.
|
||||
cryptpad.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9030 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
header_up X-Forwarded-Port 443
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# 9031 meet (Jitsi) — allocated 2026-09-08
|
||||
# Merge: scripts/caddy/caddy-apply.sh --site meet.hacktivism.ch --port 9031 --label meet
|
||||
# WebRTC media (UDP/JVB) is separate from this HTTPS vhost — VeciGate/firewall later.
|
||||
meet.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9031 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
header_up X-Forwarded-Port 443
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch, http://lemmy.hacktivism.ch, http://decidim.hacktivism.ch, http://galene.hacktivism.ch, http://cryptpad.hacktivism.ch, http://meet.hacktivism.ch {
|
||||
handle /.well-known/acme-challenge/* {
|
||||
root * /var/www/acme
|
||||
file_server
|
||||
}
|
||||
handle {
|
||||
redir https://{host}{uri} permanent
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue