# Caddy on koopa

Live: **`/etc/caddy/Caddyfile`**.  
Mirror: **`configs/caddy/Caddyfile`** (same as `host/caddy/Caddyfile`).

## Reload after edit

```bash
sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy
```

Preferred live path: edit `~/koopa-caddy/Caddyfile`, then `sudo ~/bin/caddy-apply`
(copies → `/etc/caddy/Caddyfile`, validate, `systemctl reload caddy`).

## GOA bank @wdGet (FP Android withdraw) — full replace

Live snapshot + `@wdGet` (GET Integration → `:9013` → demo-api):

- `Caddyfile.koopa-live-wdGet` — whole-file replacement (based on live koopa, not admin-log mirror)
- `apply-goa-wdGet-full-replace.sh` — replaces `~/koopa-caddy/Caddyfile` **and** `/etc/caddy/Caddyfile`, reload, smoke

```bash
# on koopa (root) — scp both files first if no admin-log checkout:
sudo bash /tmp/goa-fp-port/caddy/apply-goa-wdGet-full-replace.sh \
  /tmp/goa-fp-port/caddy/Caddyfile.koopa-live-wdGet
```

FP SoT: `$HOME/git/admin-logs/taler/francpaysan-admin-log` `files/caddy/Caddyfile` `@wdGet`.

## dossiers.ngi* — basic_auth (htaccess-in-front)

Caddy **ignores** Apache `.htaccess`. Use:

```bash
# clone koopa-admin-log from Forgejo when needed (no permanent ~/ clone)
sudo bash /path/to/koopa-admin-log/scripts/caddy/apply-dossiers-ngi-basicauth.sh
```

Host runtime: `/etc/caddy/secrets/dossiers-ngi-basicauth.txt` (root-only).  
SoT: `koopa-admin-secrets-enc` (git-crypt) → `koopa/home-hernani/caddy/`.  
Hosts: `dossiers.ngi` / `dossiers.2.ngi` / `dossiers.3.ngi`.hacktivism.ch

## silverbullet.hacktivism.ch — merge + basic_auth

After podman cutover (`scripts/notes/cutover-to-silverbullet.sh --apply`) and DNS:

```bash
# laptop: SoT → /tmp seed (no secret echo)
bash /path/to/koopa-admin-log/scripts/notes/prepare-basicauth-seed.sh
scp /tmp/silverbullet-basicauth-seed.txt hernani@koopa:/tmp/

# koopa root:
sudo bash /path/to/koopa-admin-log/scripts/caddy/merge-notes-site.sh
sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \
  bash /path/to/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh
```

`merge-notes-site.sh` renames leftover `freenotes`/`notes` site blocks → `silverbullet.hacktivism.ch`.  
Host runtime: `/etc/caddy/secrets/silverbullet-basicauth.txt` (root-only).  
SoT: `koopa-admin-secrets-enc` (git-crypt) → `koopa/home-hernani/caddy/silverbullet-basicauth.txt`.

## New HTTPS vhost — `caddy-apply.sh`

Generic merge (site snippet + ACME `http://` list + ports comment):

```bash
# laptop mirror (no reload):
bash scripts/caddy/caddy-apply.sh \
  --config configs/caddy/Caddyfile \
  --snippet configs/caddy/galene.hacktivism.ch.caddy \
  --site galene.hacktivism.ch --port 9029 --label galene \
  --no-reload

# koopa live (root):
sudo bash …/scripts/caddy/caddy-apply.sh \
  --snippet …/configs/caddy/SITE.caddy \
  --site SITE.hacktivism.ch --port NNNN --label NAME
```

Allocated collab vhosts (2026-09-08): `galene` **9029**, `cryptpad` **9030**, `meet` **9031**, `bbb` **9032**.  
Snippets under `configs/caddy/*.hacktivism.ch.caddy`. Image bases: CachyOS except **bbb=Ubuntu**.

Still valid: hand-edit live + mirror, then validate/reload.