caddy: 8085/8443 + systemd 80/443 proxies; drop --resume

host/caddy/Caddyfile

@@ -1,5 +1,7 @@
-# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
 {
+	email info+koopa@hacktivism.ch
+	http_port 8085
+	https_port 8443
 	auto_https disable_redirects
 }
 taler.hacktivism.ch {

host/systemd/README.md

@@ -0,0 +1,13 @@
+# systemd units (host)
+
+| Unit | Role |
+|------|------|
+| `caddy.service` | reverse proxy (drop-in: no `--resume`) |
+| `http-proxy.socket` | bind **:80** → `systemd-socket-proxyd` → `127.0.0.1:9000` |
+| `https-proxy.socket` | bind **:443** → `systemd-socket-proxyd` → `127.0.0.1:9001` |
+| `https-proxy@.service` | template: `systemd-socket-proxyd 127.0.0.1:%i` |
+| `firewalld.service` | host firewall |
+| `sshd.service` | SSH |
+| `tor.service` | Tor relay (ORPort 8080) |
+
+Privileged ports 80/443 are held by **systemd**, not by Caddy (Caddy listens on 9000/9001 as user `caddy`).

host/systemd/caddy.service.d-no-resume.conf

@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile

host/systemd/http-proxy.socket

@@ -0,0 +1,11 @@
+[Unit]
+Description=Forward incoming HTTP :80 to Caddy on 127.0.0.1:9000
+
+[Socket]
+ListenStream=0.0.0.0:80
+ListenStream=[::]:80
+BindIPv6Only=yes
+Service=https-proxy@9000.service
+
+[Install]
+WantedBy=sockets.target

host/systemd/https-proxy.socket

@@ -0,0 +1,11 @@
+[Unit]
+Description=Forward incoming HTTPS :443 to Caddy on 127.0.0.1:9001
+
+[Socket]
+ListenStream=0.0.0.0:443
+ListenStream=[::]:443
+BindIPv6Only=yes
+Service=https-proxy@9001.service
+
+[Install]
+WantedBy=sockets.target

host/systemd/https-proxy@.service

@@ -0,0 +1,5 @@
+[Unit]
+Description=Proxy for incoming HTTPS traffic to port %i
+
+[Service]
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:%i