From 078c32cdc3757f1754bfbdbab57f1cb4ccc00d19 Mon Sep 17 00:00:00 2001 From: Phil Date: Sat, 31 Oct 2026 09:05:22 -0600 Subject: [PATCH] Answer every apex WebFinger query with phil's record Tailscale's issuer lookup didn't match the resource=acct:phil@ filter, got redirected to GoToSocial, found no issuer and fell back to Authentik. phil is the only account here, so serve the same record for all queries. Co-Authored-By: Claude Opus 5.5 --- roles/docker/templates/Caddyfile.j2 | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/roles/docker/templates/Caddyfile.j2 b/roles/docker/templates/Caddyfile.j2 index bc12601..fedc1c5 100644 --- a/roles/docker/templates/Caddyfile.j2 +++ b/roles/docker/templates/Caddyfile.j2 @@ -48,16 +48,14 @@ thesatelliteoflove.com { # WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account # domain is this apex) and Tailscale, which finds the tailnet's login # provider through the OpenID issuer link. - @webfinger_phil { - path /.well-known/webfinger - query resource=acct:phil@{{ primary_domain }} - } + # Answered for every query: Tailscale's lookup doesn't always send + # resource=acct:phil@..., and phil is the only account here anyway. + @webfinger_phil path /.well-known/webfinger route { header @webfinger_phil Content-Type application/jrd+json header @webfinger_phil Access-Control-Allow-Origin * respond @webfinger_phil `{"subject":"acct:phil@{{ primary_domain }}","aliases":["https://{{ subdomains.social }}/users/phil","https://{{ subdomains.social }}/@phil"],"links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://{{ subdomains.pocketid }}"},{"rel":"http://webfinger.net/rel/profile-page","type":"text/html","href":"https://{{ subdomains.social }}/@phil"},{"rel":"self","type":"application/activity+json","href":"https://{{ subdomains.social }}/users/phil"}]}` 200 # Other fediverse discovery goes to GoToSocial. - redir /.well-known/webfinger https://{{ subdomains.social }}{uri} 301 redir /.well-known/host-meta* https://{{ subdomains.social }}{uri} 301 redir /.well-known/nodeinfo https://{{ subdomains.social }}{uri} 301 }