Files
ansible/roles/docker/templates/Caddyfile.j2
T
PhilandClaude Opus 5.5 c9c05df534 Serve WebFinger on the apex domain for Tailscale and the fediverse
Tailscale finds the tailnet's login provider through the OpenID issuer
link in phil@'s WebFinger record, which now points at Pocket ID. The
same record carries GoToSocial's links, since the apex is its account
domain; other fediverse discovery paths redirect to GoToSocial. All of
these returned 404 before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-31 08:55:08 -06:00

151 lines
3.6 KiB
Caddyfile

auth.thesatelliteoflove.com {
reverse_proxy authentik-server-1:9000
}
{{ subdomains.pocketid }} {
reverse_proxy pocket-id:1411
}
paper.thesatelliteoflove.com {
reverse_proxy paperlessngx-webserver-1:8000
}
cal.thesatelliteoflove.com {
redir /.well-known/caldav /dav.php 302
redir /.well-known/carddav /dav.php 302
reverse_proxy baikal-baikal-1:80
}
books.thesatelliteoflove.com {
reverse_proxy authentik-server-1:9000
}
{{ subdomains.kavita }} {
reverse_proxy kavita:5000
}
audio.thesatelliteoflove.com {
reverse_proxy audiobookshelf-audiobookshelf-1:80
}
loclog.thesatelliteoflove.com {
reverse_proxy dawarich_app:3000
}
watcher.thesatelliteoflove.com {
reverse_proxy changedetection:5000
}
snippets.thesatelliteoflove.com {
reverse_proxy bytestash:5000
}
git.thesatelliteoflove.com {
reverse_proxy gitea:3000
}
thesatelliteoflove.com {
# WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account
# domain is this apex) and Tailscale, which finds the tailnet's login
# provider through the OpenID issuer link.
@webfinger_phil {
path /.well-known/webfinger
query resource=acct:phil@{{ primary_domain }}
}
route {
header @webfinger_phil Content-Type application/jrd+json
header @webfinger_phil Access-Control-Allow-Origin *
respond @webfinger_phil `{"subject":"acct:phil@{{ primary_domain }}","aliases":["https://{{ subdomains.social }}/users/phil","https://{{ subdomains.social }}/@phil"],"links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://{{ subdomains.pocketid }}"},{"rel":"http://webfinger.net/rel/profile-page","type":"text/html","href":"https://{{ subdomains.social }}/@phil"},{"rel":"self","type":"application/activity+json","href":"https://{{ subdomains.social }}/users/phil"}]}` 200
# Other fediverse discovery goes to GoToSocial.
redir /.well-known/webfinger https://{{ subdomains.social }}{uri} 301
redir /.well-known/host-meta* https://{{ subdomains.social }}{uri} 301
redir /.well-known/nodeinfo https://{{ subdomains.social }}{uri} 301
}
root * /srv/tsol
file_server
}
bookmarks.thesatelliteoflove.com {
reverse_proxy hoarder-web-1:3000
}
social.thesatelliteoflove.com {
reverse_proxy gotosocial:8080
}
models.thesatelliteoflove.com {
reverse_proxy manyfold-app-1:3214
}
gotify.thesatelliteoflove.com {
reverse_proxy gotify:80
}
gotify-assistant.thesatelliteoflove.com {
reverse_proxy igotify-assistant:8080
}
pdg.thesatelliteoflove.com {
root * /srv/pdg
try_files {path} {path}.html {path}/ =404
file_server
encode gzip
handle_errors {
rewrite * /{err.status_code}.html
file_server
}
}
gondulf.thesatelliteoflove.com {
reverse_proxy gondulf:8000
}
starpunk.thesatelliteoflove.com {
reverse_proxy starpunk:8000
}
godulf.thesatelliteoflove.com {
reverse_proxy gondulf:8000
}
repair.nerder.land {
root * /srv/repair
file_server
}
nerder.land {
root * /srv/nerderland
file_server
}
forms.nerder.land {
reverse_proxy heyform-heyform-1:8000
}
listmonk.nerder.land {
reverse_proxy listmonk:9000
}
repaircafe.nerder.land {
redir /volunteer-signup https://listmonk.nerder.land/subscription/form 301
}
{% if vault_dir2opds is defined %}
opds.thesatelliteoflove.com {
basicauth {
{{ dir2opds_basic_auth_hash_result.stdout }}
}
reverse_proxy dir2opds:8080
}
{% endif %}
gokapi.thesatelliteoflove.com {
reverse_proxy gokapi:53842
}
sync.thesatelliteoflove.com {
reverse_proxy kosync:17200
}