koopa-admin-log/scripts/caddy

Caddy on koopa

Live: /etc/caddy/Caddyfile.
Mirror: configs/caddy/Caddyfile (same as host/caddy/Caddyfile).

Reload after edit

sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy

dossiers.ngi* — basic_auth (htaccess-in-front)

Caddy ignores Apache .htaccess. Use:

# clone koopa-admin-log from Forgejo when needed (no permanent ~/ clone)
sudo bash /path/to/koopa-admin-log/scripts/caddy/apply-dossiers-ngi-basicauth.sh

Host runtime: /etc/caddy/secrets/dossiers-ngi-basicauth.txt (root-only).
SoT: koopa-admin-secrets-enc (git-crypt) → koopa/home-hernani/caddy/.
Hosts: dossiers.ngi / dossiers.2.ngi / dossiers.3.ngi.hacktivism.ch

silverbullet.hacktivism.ch — merge + basic_auth

After podman cutover (scripts/notes/cutover-to-silverbullet.sh --apply) and DNS:

# laptop: SoT → /tmp seed (no secret echo)
bash /path/to/koopa-admin-log/scripts/notes/prepare-basicauth-seed.sh
scp /tmp/silverbullet-basicauth-seed.txt hernani@koopa:/tmp/

# koopa root:
sudo bash /path/to/koopa-admin-log/scripts/caddy/merge-notes-site.sh
sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \
  bash /path/to/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh

merge-notes-site.sh renames leftover freenotes/notes site blocks → silverbullet.hacktivism.ch.
Host runtime: /etc/caddy/secrets/silverbullet-basicauth.txt (root-only).
SoT: koopa-admin-secrets-enc (git-crypt) → koopa/home-hernani/caddy/silverbullet-basicauth.txt.

New HTTPS vhost — caddy-apply.sh

Generic merge (site snippet + ACME http:// list + ports comment):

# laptop mirror (no reload):
bash scripts/caddy/caddy-apply.sh \
  --config configs/caddy/Caddyfile \
  --snippet configs/caddy/galene.hacktivism.ch.caddy \
  --site galene.hacktivism.ch --port 9029 --label galene \
  --no-reload

# koopa live (root):
sudo bash …/scripts/caddy/caddy-apply.sh \
  --snippet …/configs/caddy/SITE.caddy \
  --site SITE.hacktivism.ch --port NNNN --label NAME

Allocated collab vhosts (2026-09-08): galene 9029, cryptpad 9030, meet 9031, bbb 9032.
Snippets under configs/caddy/*.hacktivism.ch.caddy. Image bases: CachyOS except bbb=Ubuntu.

Still valid: hand-edit live + mirror, then validate/reload.