PhilandClaude Opus 5.5
a1a79af7d5
v0.1.0 (Feb 2025) has dozens of published security advisories fixed in v3. Tested against a copy of the database first; forms load unchanged. v3 listens on 9157, keeps uploads under packages/server, and uses Redis 8 commands, so KeyDB is replaced by redis:8-alpine. The homepage URL is now https (v3's CORS allowlist is built from it), Caddy is the trusted proxy, public sign-up is off, and integration credentials get their own key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
121 lines
3.0 KiB
Caddyfile
121 lines
3.0 KiB
Caddyfile
{{ subdomains.pocketid }} {
|
|
reverse_proxy pocket-id:1411
|
|
}
|
|
|
|
paper.thesatelliteoflove.com {
|
|
reverse_proxy paperlessngx-webserver-1:8000
|
|
}
|
|
|
|
cal.thesatelliteoflove.com {
|
|
redir /.well-known/caldav /dav.php 302
|
|
redir /.well-known/carddav /dav.php 302
|
|
reverse_proxy baikal-baikal-1:80
|
|
}
|
|
|
|
{{ subdomains.books }} {
|
|
reverse_proxy kavita:5000
|
|
}
|
|
|
|
audio.thesatelliteoflove.com {
|
|
reverse_proxy audiobookshelf-audiobookshelf-1:80
|
|
}
|
|
|
|
loclog.thesatelliteoflove.com {
|
|
reverse_proxy dawarich_app:3000
|
|
}
|
|
|
|
watcher.thesatelliteoflove.com {
|
|
reverse_proxy changedetection:5000
|
|
}
|
|
|
|
snippets.thesatelliteoflove.com {
|
|
reverse_proxy bytestash:5000
|
|
}
|
|
|
|
git.thesatelliteoflove.com {
|
|
reverse_proxy gitea:3000
|
|
}
|
|
|
|
thesatelliteoflove.com {
|
|
# WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account
|
|
# domain is this apex) and Tailscale, which finds the tailnet's login
|
|
# provider through the OpenID issuer link.
|
|
# Answered for every query: Tailscale's lookup doesn't always send
|
|
# resource=acct:phil@..., and phil is the only account here anyway.
|
|
@webfinger_phil path /.well-known/webfinger
|
|
route {
|
|
header @webfinger_phil Content-Type application/jrd+json
|
|
header @webfinger_phil Access-Control-Allow-Origin *
|
|
respond @webfinger_phil `{"subject":"acct:phil@{{ primary_domain }}","aliases":["https://{{ subdomains.social }}/users/phil","https://{{ subdomains.social }}/@phil"],"links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://{{ subdomains.pocketid }}"},{"rel":"http://webfinger.net/rel/profile-page","type":"text/html","href":"https://{{ subdomains.social }}/@phil"},{"rel":"self","type":"application/activity+json","href":"https://{{ subdomains.social }}/users/phil"}]}` 200
|
|
# Other fediverse discovery goes to GoToSocial.
|
|
redir /.well-known/host-meta* https://{{ subdomains.social }}{uri} 301
|
|
redir /.well-known/nodeinfo https://{{ subdomains.social }}{uri} 301
|
|
}
|
|
root * /srv/tsol
|
|
file_server
|
|
}
|
|
|
|
bookmarks.thesatelliteoflove.com {
|
|
reverse_proxy hoarder-web-1:3000
|
|
}
|
|
|
|
social.thesatelliteoflove.com {
|
|
reverse_proxy gotosocial:8080
|
|
}
|
|
|
|
models.thesatelliteoflove.com {
|
|
reverse_proxy manyfold-app-1:3214
|
|
}
|
|
|
|
|
|
gotify.thesatelliteoflove.com {
|
|
reverse_proxy gotify:80
|
|
}
|
|
|
|
gotify-assistant.thesatelliteoflove.com {
|
|
reverse_proxy igotify-assistant:8080
|
|
}
|
|
|
|
pdg.thesatelliteoflove.com {
|
|
root * /srv/pdg
|
|
try_files {path} {path}.html {path}/ =404
|
|
file_server
|
|
encode gzip
|
|
|
|
handle_errors {
|
|
rewrite * /{err.status_code}.html
|
|
file_server
|
|
}
|
|
}
|
|
|
|
starpunk.thesatelliteoflove.com {
|
|
reverse_proxy starpunk:8000
|
|
}
|
|
|
|
repair.nerder.land {
|
|
root * /srv/repair
|
|
file_server
|
|
}
|
|
|
|
nerder.land {
|
|
root * /srv/nerderland
|
|
file_server
|
|
}
|
|
|
|
forms.nerder.land {
|
|
reverse_proxy heyform-heyform-1:9157
|
|
}
|
|
|
|
listmonk.nerder.land {
|
|
reverse_proxy listmonk:9000
|
|
}
|
|
|
|
repaircafe.nerder.land {
|
|
redir /volunteer-signup https://listmonk.nerder.land/subscription/form 301
|
|
}
|
|
|
|
gokapi.thesatelliteoflove.com {
|
|
reverse_proxy gokapi:53842
|
|
}
|
|
|