From fe0c1e2b537924a4c4da03b5c4f9af769e6ef391 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= <hernani+magikoopa@vecirex.net>
Date: Sat, 10 Oct 2026 00:49:58 +0200
Subject: [PATCH] feat/dossiers-ngi: add Caddy handle docs for cascade sticky
 bar

---
 scripts/caddy/README.md        |  4 ++++
 scripts/dossiers-ngi/README.md | 25 +++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/scripts/caddy/README.md b/scripts/caddy/README.md
index 4d1fc8c..ae4921d 100644
--- a/scripts/caddy/README.md
+++ b/scripts/caddy/README.md
@@ -41,6 +41,10 @@ Host runtime: `/etc/caddy/secrets/dossiers-ngi-basicauth.txt` (root-only).
 SoT: `koopa-admin-secrets-enc` (git-crypt) → `koopa/home-hernani/caddy/`.  
 Hosts: `dossiers.ngi` / `dossiers.2.ngi` / `dossiers.3.ngi`.hacktivism.ch
 
+HTTP→HTTPS 308 for `dossiers.ngi` (add host to the shared ACME list, leave
+HTTPS body alone): `scripts/dossiers-ngi/apply-dossiers-ngi-http-308.sh`
+then `sudo ~/bin/caddy-apply`.
+
 ## silverbullet.hacktivism.ch — merge + basic_auth
 
 After podman cutover (`scripts/notes/cutover-to-silverbullet.sh --apply`) and DNS:
diff --git a/scripts/dossiers-ngi/README.md b/scripts/dossiers-ngi/README.md
index d4f2efa..6b9b65c 100644
--- a/scripts/dossiers-ngi/README.md
+++ b/scripts/dossiers-ngi/README.md
@@ -136,5 +136,30 @@ sudo ~/bin/caddy-apply
 
 Stanza SoT: `scripts/dossiers-ngi/caddy-dossiers-ngi.snippet`.
 
+## HTTP → HTTPS 308
+
+Shared Caddy HTTP list already `redir https://{host}{uri} permanent` (308).
+`dossiers.ngi.hacktivism.ch` was missing there → HTTP `200` empty body /
+Firefox `NS_ERROR_NET_EMPTY_RESPONSE`. HTTPS site body stays untouched.
+
+On koopa (hernani, then root apply):
+
+```bash
+# SoT: scripts/dossiers-ngi/apply-dossiers-ngi-http-308.sh
+cp /path/to/apply-dossiers-ngi-http-308.sh ~/bin/
+chmod +x ~/bin/apply-dossiers-ngi-http-308.sh
+bash ~/bin/apply-dossiers-ngi-http-308.sh
+sudo ~/bin/caddy-apply
+```
+
+Smoke after apply:
+
+```bash
+curl -sSI http://dossiers.ngi.hacktivism.ch/ | grep -Ei 'HTTP|location'
+# 308  Location: https://dossiers.ngi.hacktivism.ch/
+```
+
+`.2` / `.3` stay off this list unless `SITE=` is set.
+
 
 Caddy edition map must list each `editions/<slug>` explicitly. A map output of `{http.request.cookie.tdpd_edition}` did not expand on Caddy v2.11.4 (only `flask` worked → 404 for `main`/views). After new tips appear, refresh the snippet map (or regenerate from `ls editions`) before `apply-dossiers-ngi-edition-switch` + `caddy-apply`.