caddy: 8085/8443 + systemd 80/443 proxies; drop --resume

configs/caddy/Caddyfile

@@ -1,5 +1,7 @@
-# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
 {
+	email info+koopa@hacktivism.ch
+	http_port 8085
+	https_port 8443
 	auto_https disable_redirects
 }
 taler.hacktivism.ch {

configs/ports.md

@@ -0,0 +1,3 @@
+# Ports
+
+80→8085, 443→8443; Caddy 8085/8443; merchant 8081

configs/systemd/caddy.service.d-no-resume.conf

@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile

configs/systemd/http-proxy.socket

@@ -0,0 +1,11 @@
+[Unit]
+Description=Forward incoming HTTP :80 to Caddy on 127.0.0.1:9000
+
+[Socket]
+ListenStream=0.0.0.0:80
+ListenStream=[::]:80
+BindIPv6Only=yes
+Service=https-proxy@9000.service
+
+[Install]
+WantedBy=sockets.target

configs/systemd/https-proxy.socket

@@ -0,0 +1,11 @@
+[Unit]
+Description=Forward incoming HTTPS :443 to Caddy on 127.0.0.1:9001
+
+[Socket]
+ListenStream=0.0.0.0:443
+ListenStream=[::]:443
+BindIPv6Only=yes
+Service=https-proxy@9001.service
+
+[Install]
+WantedBy=sockets.target

configs/systemd/https-proxy@.service

@@ -0,0 +1,5 @@
+[Unit]
+Description=Proxy for incoming HTTPS traffic to port %i
+
+[Service]
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:%i