caddy: HTTP 9000 HTTPS 9001; ACME webroot; firewalld open 9000/9001/80

configs/caddy/Caddyfile

@@ -1,13 +1,140 @@
+# Internal only (not in the browser URL):
+# 9010 merchant API | 9011 exchange API | 9012 bank API
+# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
+# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt
+
 {
 	email info+koopa@hacktivism.ch
-	http_port 8085
-	https_port 8443
+	http_port 9000
+	https_port 9001
 	auto_https disable_redirects
-}
-taler.hacktivism.ch {
-	tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
-	reverse_proxy https://127.0.0.1:8081 {
-		transport http { tls_insecure_skip_verify }
-		header_up Host {host}
+	# Caddy listens on 9001 behind VeciGate/https-proxy :443.
+	# Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
+	servers {
+		protocols h1 h2
+	}
+}
+
+(proxy_public) {
+	header_up Host {host}
+	header_up X-Forwarded-Host {host}
+	header_up X-Forwarded-Proto {scheme}
+	header_up X-Forwarded-Port 443
+	header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
+}
+
+taler.hacktivism.ch {
+	tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
+	header Alt-Svc "clear"
+
+	# Public landing first
+	redir / /intro/ 302
+
+	handle /intro* {
+		reverse_proxy 127.0.0.1:9015 {
+			import proxy_public
+		}
+	}
+
+	# SPA: /webui → /webui/
+	redir /webui /webui/ 302
+
+	# Merchant API + WebUI (nginx :9010 → unix socket)
+	reverse_proxy https://127.0.0.1:9010 {
+		transport http {
+			tls_insecure_skip_verify
+		}
+		import proxy_public
+	}
+}
+
+exchange.hacktivism.ch {
+	tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
+	header Alt-Svc "clear"
+
+	# Public landing first
+	redir / /intro/ 302
+
+	handle /intro* {
+		reverse_proxy 127.0.0.1:9014 {
+			import proxy_public
+		}
+	}
+
+	reverse_proxy 127.0.0.1:9011 {
+		import proxy_public
+	}
+}
+
+bank.hacktivism.ch {
+	header Alt-Svc "clear"
+
+	# Public landing first
+	redir / /intro/ 302
+
+	handle /intro* {
+		reverse_proxy 127.0.0.1:9013 {
+			import proxy_public
+		}
+	}
+
+	# Static terms/privacy on landing nginx :9013 (optional; needs locations there)
+	handle /terms* {
+		reverse_proxy 127.0.0.1:9013 {
+			import proxy_public
+		}
+	}
+	handle /privacy* {
+		reverse_proxy 127.0.0.1:9013 {
+			import proxy_public
+		}
+	}
+
+	reverse_proxy 127.0.0.1:9012 {
+		import proxy_public
+	}
+}
+
+castopod.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9020 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+	}
+}
+
+bonfire.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9021 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+		flush_interval -1
+	}
+}
+
+prime.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9022 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+		flush_interval -1
+	}
+}
+
+bt.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9023 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+	}
+}
+
+http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch {
+	handle /.well-known/acme-challenge/* {
+		root * /var/www/acme
+		file_server
+	}
+	handle {
+		redir https://{host}{uri} permanent
 	}
 }

configs/firewalld/public-ports.md

@@ -0,0 +1,3 @@
+# firewalld
+
+Open 9000/9001/80. Drop 443/8082 next.

configs/ports.md

@@ -1,3 +1,19 @@
-# Ports
+# Port map (see also host/overview/services.md)
 
-80→8085, 443→8443; Caddy 8085/8443; merchant 8081
+| Port | Role |
+|------|------|
+| 22 | sshd (WAN often via VeciGate 23235) |
+| 80 | systemd `http-proxy.socket` → Caddy **9000** |
+| 443 | systemd `https-proxy.socket` → Caddy **9001** |
+| 9000 | Caddy HTTP + ACME webroot |
+| 9001 | Caddy HTTPS (vhosts) |
+| 9010 | podman `taler-hacktivism` (merchant nginx TLS) — **not** in firewalld |
+| 9011 | podman `taler-exchange-hacktivism` (exchange httpd) — **not** in firewalld |
+| 9012 | podman `taler-bank-hacktivism` (libeufin-bank) — **not** in firewalld |
+| 9020 | podman `koopa-castopod` (HTTP) → Caddy `castopod.hacktivism.ch` |
+| 9021 | podman `koopa-bonfire` → Caddy `bonfire.hacktivism.ch` |
+| 8080 | Tor ORPort |
+
+VeciGate: WAN **80→9000**, WAN **443→9001**.  
+Public Taler: Caddy vhosts on **9001** → 127.0.0.1:{9010,9011,9012}.  
+Planned SM: Caddy → 127.0.0.1:9020+ (not deployed yet).