6c92cd1c1b
Document merchant JSON code 21 on /monitoring* as infra (not suite). Topic note, day log, ISSUES I-09, pointer README, sync prepared Caddyfile.
311 lines
8.3 KiB
Caddyfile
311 lines
8.3 KiB
Caddyfile
# Internal only (not in the browser URL):
|
|
# 9010 merchant API | 9011 exchange API | 9012 bank API
|
|
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
|
|
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9200 forgejo-ssh
|
|
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
|
|
{
|
|
email info+koopa@hacktivism.ch
|
|
http_port 9000
|
|
https_port 9001
|
|
auto_https disable_redirects
|
|
# Caddy listens on 9001 behind VeciGate/https-proxy :443.
|
|
# Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
|
|
servers {
|
|
protocols h1 h2
|
|
}
|
|
}
|
|
|
|
(proxy_public) {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-Host {host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Forwarded-Port 443
|
|
header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
|
|
}
|
|
|
|
taler.hacktivism.ch {
|
|
tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
|
|
header Alt-Svc "clear"
|
|
|
|
# Public landing first
|
|
redir / /intro/ 302
|
|
|
|
handle /intro* {
|
|
reverse_proxy 127.0.0.1:9015 {
|
|
import proxy_public
|
|
}
|
|
}
|
|
|
|
# surface + aptdeploy HTML (taler.hacktivism.ch only)
|
|
handle /taler-monitoring-surface_err {
|
|
redir /taler-monitoring-surface_err/ 302
|
|
}
|
|
handle /taler-monitoring-surface_err/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-surface_err
|
|
file_server
|
|
}
|
|
handle /taler-monitoring-surface {
|
|
redir /taler-monitoring-surface/ 302
|
|
}
|
|
handle /taler-monitoring-surface/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-surface
|
|
file_server
|
|
}
|
|
handle /taler-monitoring-aptdeploy_err {
|
|
redir /taler-monitoring-aptdeploy_err/ 302
|
|
}
|
|
handle /taler-monitoring-aptdeploy_err/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-aptdeploy_err
|
|
file_server
|
|
}
|
|
handle /taler-monitoring-aptdeploy {
|
|
redir /taler-monitoring-aptdeploy/ 302
|
|
}
|
|
handle /taler-monitoring-aptdeploy/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-aptdeploy
|
|
file_server
|
|
}
|
|
|
|
handle /taler-monitoring-mattermost_err {
|
|
redir /taler-monitoring-mattermost_err/ 302
|
|
}
|
|
handle /taler-monitoring-mattermost_err/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mattermost_err
|
|
file_server
|
|
}
|
|
handle /taler-monitoring-mattermost {
|
|
redir /taler-monitoring-mattermost/ 302
|
|
}
|
|
handle /taler-monitoring-mattermost/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mattermost
|
|
file_server
|
|
}
|
|
|
|
handle /taler-monitoring-mail_err {
|
|
redir /taler-monitoring-mail_err/ 302
|
|
}
|
|
handle /taler-monitoring-mail_err/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mail_err
|
|
file_server
|
|
}
|
|
handle /taler-monitoring-mail {
|
|
redir /taler-monitoring-mail/ 302
|
|
}
|
|
handle /taler-monitoring-mail/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/taler-monitoring-mail
|
|
file_server
|
|
}
|
|
|
|
# taler-monitoring console HTML (host static — not in app containers)
|
|
handle /monitoring_err {
|
|
redir /monitoring_err/ 302
|
|
}
|
|
handle /monitoring_err/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/monitoring_err
|
|
file_server
|
|
}
|
|
handle /monitoring {
|
|
redir /monitoring/ 302
|
|
}
|
|
handle /monitoring/ {
|
|
root * /var/www/monitoring-sites/taler.hacktivism.ch/monitoring
|
|
file_server
|
|
}
|
|
|
|
|
|
|
|
|
|
# SPA: /webui → /webui/
|
|
redir /webui /webui/ 302
|
|
|
|
# Merchant API + WebUI (nginx :9010 → unix socket)
|
|
reverse_proxy https://127.0.0.1:9010 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
import proxy_public
|
|
}
|
|
}
|
|
|
|
exchange.hacktivism.ch {
|
|
tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
|
|
header Alt-Svc "clear"
|
|
|
|
# Public landing first
|
|
redir / /intro/ 302
|
|
|
|
handle /intro* {
|
|
reverse_proxy 127.0.0.1:9014 {
|
|
import proxy_public
|
|
}
|
|
}
|
|
|
|
# taler-monitoring console HTML (host static — not in app containers)
|
|
handle /monitoring_err {
|
|
redir /monitoring_err/ 302
|
|
}
|
|
handle /monitoring_err/ {
|
|
root * /var/www/monitoring-sites/exchange.hacktivism.ch/monitoring_err
|
|
file_server
|
|
}
|
|
handle /monitoring {
|
|
redir /monitoring/ 302
|
|
}
|
|
handle /monitoring/ {
|
|
root * /var/www/monitoring-sites/exchange.hacktivism.ch/monitoring
|
|
file_server
|
|
}
|
|
|
|
|
|
reverse_proxy 127.0.0.1:9011 {
|
|
import proxy_public
|
|
}
|
|
}
|
|
|
|
bank.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
|
|
# Public landing first
|
|
redir / /intro/ 302
|
|
|
|
handle /intro* {
|
|
reverse_proxy 127.0.0.1:9013 {
|
|
import proxy_public
|
|
}
|
|
}
|
|
|
|
# taler-monitoring console HTML (host static — not in app containers)
|
|
handle /monitoring_err {
|
|
redir /monitoring_err/ 302
|
|
}
|
|
handle /monitoring_err/ {
|
|
root * /var/www/monitoring-sites/bank.hacktivism.ch/monitoring_err
|
|
file_server
|
|
}
|
|
handle /monitoring {
|
|
redir /monitoring/ 302
|
|
}
|
|
handle /monitoring/ {
|
|
root * /var/www/monitoring-sites/bank.hacktivism.ch/monitoring
|
|
file_server
|
|
}
|
|
|
|
|
|
# Static terms/privacy on landing nginx :9013
|
|
handle /terms* {
|
|
reverse_proxy 127.0.0.1:9013 {
|
|
import proxy_public
|
|
}
|
|
}
|
|
handle /privacy* {
|
|
reverse_proxy 127.0.0.1:9013 {
|
|
import proxy_public
|
|
}
|
|
}
|
|
|
|
reverse_proxy 127.0.0.1:9012 {
|
|
import proxy_public
|
|
}
|
|
}
|
|
|
|
castopod.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9020 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
}
|
|
}
|
|
|
|
bonfire.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9021 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
prime.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9022 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
bt.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9023 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
}
|
|
}
|
|
|
|
# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
|
|
git.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9024 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
flush_interval -1
|
|
transport http {
|
|
read_timeout 3600s
|
|
write_timeout 3600s
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
# Taler Operations design previews (static nginx)
|
|
tops.ng1.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9090 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
}
|
|
}
|
|
|
|
tops.ng2.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9091 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
}
|
|
}
|
|
|
|
tops.ng3.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9092 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
}
|
|
}
|
|
|
|
|
|
# 9025 paivana-httpd (GOA paywall)
|
|
paivana.hacktivism.ch {
|
|
header Alt-Svc "clear"
|
|
reverse_proxy 127.0.0.1:9025 {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Host {host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Forwarded-Port 443
|
|
}
|
|
}
|
|
|
|
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
|
|
handle /.well-known/acme-challenge/* {
|
|
root * /var/www/acme
|
|
file_server
|
|
}
|
|
handle {
|
|
redir https://{host}{uri} permanent
|
|
}
|
|
}
|