hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

caddy: 8085/8443 + systemd 80/443 proxies; drop --resume

Browse source
This commit is contained in:
Hernâni Marques 2026-07-08 14:29:13 +02:00
parent 72c67f9b24
commit b587bb0eeb
No known key found for this signature in database
12 changed files with 82 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
configs/caddy/Caddyfile
View file

@ -1,5 +1,7 @@
# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
{ {
email info+koopa@hacktivism.ch
http_port 8085
https_port 8443
auto_https disable_redirects auto_https disable_redirects
} }
taler.hacktivism.ch { taler.hacktivism.ch {

3
configs/ports.md Normal file
View file

@ -0,0 +1,3 @@
# Ports
80→8085, 443→8443; Caddy 8085/8443; merchant 8081

3
configs/systemd/caddy.service.d-no-resume.conf Normal file
View file

@ -0,0 +1,3 @@
[Service]
ExecStart=
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile

11
configs/systemd/http-proxy.socket Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Forward incoming HTTP :80 to Caddy on 127.0.0.1:9000
[Socket]
ListenStream=0.0.0.0:80
ListenStream=[::]:80
BindIPv6Only=yes
Service=https-proxy@9000.service
[Install]
WantedBy=sockets.target

11
configs/systemd/https-proxy.socket Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Forward incoming HTTPS :443 to Caddy on 127.0.0.1:9001
[Socket]
ListenStream=0.0.0.0:443
ListenStream=[::]:443
BindIPv6Only=yes
Service=https-proxy@9001.service
[Install]
WantedBy=sockets.target

5
configs/systemd/https-proxy@.service Normal file
View file

@ -0,0 +1,5 @@
[Unit]
Description=Proxy for incoming HTTPS traffic to port %i
[Service]
ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:%i

4
host/caddy/Caddyfile
View file

@ -1,5 +1,7 @@
# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
{ {
email info+koopa@hacktivism.ch
http_port 8085
https_port 8443
auto_https disable_redirects auto_https disable_redirects
} }
taler.hacktivism.ch { taler.hacktivism.ch {

13
host/systemd/README.md Normal file
View file

@ -0,0 +1,13 @@
# systemd units (host)
| Unit | Role |
|------|------|
| `caddy.service` | reverse proxy (drop-in: no `--resume`) |
| `http-proxy.socket` | bind **:80** → `systemd-socket-proxyd` → `127.0.0.1:9000` |
| `https-proxy.socket` | bind **:443** → `systemd-socket-proxyd` → `127.0.0.1:9001` |
| `https-proxy@.service` | template: `systemd-socket-proxyd 127.0.0.1:%i` |
| `firewalld.service` | host firewall |
| `sshd.service` | SSH |
| `tor.service` | Tor relay (ORPort 8080) |
Privileged ports 80/443 are held by **systemd**, not by Caddy (Caddy listens on 9000/9001 as user `caddy`).

3
host/systemd/caddy.service.d-no-resume.conf Normal file
View file

@ -0,0 +1,3 @@
[Service]
ExecStart=
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile

11
host/systemd/http-proxy.socket Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Forward incoming HTTP :80 to Caddy on 127.0.0.1:9000
[Socket]
ListenStream=0.0.0.0:80
ListenStream=[::]:80
BindIPv6Only=yes
Service=https-proxy@9000.service
[Install]
WantedBy=sockets.target

11
host/systemd/https-proxy.socket Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Forward incoming HTTPS :443 to Caddy on 127.0.0.1:9001
[Socket]
ListenStream=0.0.0.0:443
ListenStream=[::]:443
BindIPv6Only=yes
Service=https-proxy@9001.service
[Install]
WantedBy=sockets.target

5
host/systemd/https-proxy@.service Normal file
View file

@ -0,0 +1,5 @@
[Unit]
Description=Proxy for incoming HTTPS traffic to port %i
[Service]
ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:%i