hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ops: paivana and caddy config refresh

Browse source
This commit is contained in:
Hernâni Marques 2026-09-09 00:52:54 +02:00
parent d8dbc6242b
commit 56f814a6de
No known key found for this signature in database
74 changed files with 4517 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

48
scripts/caddy/README.md
View file

@ -15,12 +15,52 @@ sudo systemctl reload caddy
Caddy **ignores** Apache `.htaccess`. Use:
```bash
sudo bash /home/hernani/koopa-admin-log/scripts/caddy/apply-dossiers-ngi-basicauth.sh
# clone koopa-admin-log from Forgejo when needed (no permanent ~/ clone)
sudo bash /path/to/koopa-admin-log/scripts/caddy/apply-dossiers-ngi-basicauth.sh
```
Password file (not git): `/home/hernani/koopa-secrets/dossiers-ngi-basicauth.txt`
Host runtime: `/etc/caddy/secrets/dossiers-ngi-basicauth.txt` (root-only).
SoT: `koopa-admin-secrets-enc` (git-crypt) → `koopa/home-hernani/caddy/`.
Hosts: `dossiers.ngi` / `dossiers.2.ngi` / `dossiers.3.ngi`.hacktivism.ch
## New HTTPS vhost
## silverbullet.hacktivism.ch — merge + basic_auth
Add a site block to the Caddyfile (live + mirror), then validate and reload. Include the host in the shared HTTP site list (ACME + redirect) at the bottom of the file.
After podman cutover (`scripts/notes/cutover-to-silverbullet.sh --apply`) and DNS:
```bash
# laptop: SoT → /tmp seed (no secret echo)
bash /path/to/koopa-admin-log/scripts/notes/prepare-basicauth-seed.sh
scp /tmp/silverbullet-basicauth-seed.txt hernani@koopa:/tmp/
# koopa root:
sudo bash /path/to/koopa-admin-log/scripts/caddy/merge-notes-site.sh
sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \
bash /path/to/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh
```
`merge-notes-site.sh` renames leftover `freenotes`/`notes` site blocks → `silverbullet.hacktivism.ch`.
Host runtime: `/etc/caddy/secrets/silverbullet-basicauth.txt` (root-only).
SoT: `koopa-admin-secrets-enc` (git-crypt) → `koopa/home-hernani/caddy/silverbullet-basicauth.txt`.
## New HTTPS vhost — `caddy-apply.sh`
Generic merge (site snippet + ACME `http://` list + ports comment):
```bash
# laptop mirror (no reload):
bash scripts/caddy/caddy-apply.sh \
--config configs/caddy/Caddyfile \
--snippet configs/caddy/galene.hacktivism.ch.caddy \
--site galene.hacktivism.ch --port 9029 --label galene \
--no-reload
# koopa live (root):
sudo bash …/scripts/caddy/caddy-apply.sh \
--snippet …/configs/caddy/SITE.caddy \
--site SITE.hacktivism.ch --port NNNN --label NAME
```
Allocated collab vhosts (2026-09-08): `galene` **9029**, `cryptpad` **9030**, `meet` **9031**, `bbb` **9032**.
Snippets under `configs/caddy/*.hacktivism.ch.caddy`. Image bases: CachyOS except **bbb=Ubuntu**.
Still valid: hand-edit live + mirror, then validate/reload.