From c9c05df534d05ae165f8fd26b1da636dd994c80b Mon Sep 17 00:00:00 2001 From: Phil Date: Sat, 31 Oct 2026 08:55:08 -0600 Subject: [PATCH] Serve WebFinger on the apex domain for Tailscale and the fediverse Tailscale finds the tailnet's login provider through the OpenID issuer link in phil@'s WebFinger record, which now points at Pocket ID. The same record carries GoToSocial's links, since the apex is its account domain; other fediverse discovery paths redirect to GoToSocial. All of these returned 404 before. Co-Authored-By: Claude Opus 5.5 --- roles/docker/templates/Caddyfile.j2 | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/roles/docker/templates/Caddyfile.j2 b/roles/docker/templates/Caddyfile.j2 index 8a2d220..bc12601 100644 --- a/roles/docker/templates/Caddyfile.j2 +++ b/roles/docker/templates/Caddyfile.j2 @@ -45,6 +45,22 @@ git.thesatelliteoflove.com { } thesatelliteoflove.com { + # WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account + # domain is this apex) and Tailscale, which finds the tailnet's login + # provider through the OpenID issuer link. + @webfinger_phil { + path /.well-known/webfinger + query resource=acct:phil@{{ primary_domain }} + } + route { + header @webfinger_phil Content-Type application/jrd+json + header @webfinger_phil Access-Control-Allow-Origin * + respond @webfinger_phil `{"subject":"acct:phil@{{ primary_domain }}","aliases":["https://{{ subdomains.social }}/users/phil","https://{{ subdomains.social }}/@phil"],"links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://{{ subdomains.pocketid }}"},{"rel":"http://webfinger.net/rel/profile-page","type":"text/html","href":"https://{{ subdomains.social }}/@phil"},{"rel":"self","type":"application/activity+json","href":"https://{{ subdomains.social }}/users/phil"}]}` 200 + # Other fediverse discovery goes to GoToSocial. + redir /.well-known/webfinger https://{{ subdomains.social }}{uri} 301 + redir /.well-known/host-meta* https://{{ subdomains.social }}{uri} 301 + redir /.well-known/nodeinfo https://{{ subdomains.social }}{uri} 301 + } root * /srv/tsol file_server }