# webfinger

A single Caddy container that serves `/.well-known/webfinger` at an apex domain
(for OIDC issuer discovery — used by Tailscale and others) and 301-redirects
everything else to a target URL.

## Required `.env` values

| Variable | Notes |
|----------|-------|
| `BASE_DOMAIN` | Apex domain to serve from (e.g. `example.com`). |
| `ISSUER_URL` | OIDC issuer for the WebFinger response (your [pocket-id](../pocket-id/)). |
| `REDIRECT_URL` | Where non-WebFinger traffic is redirected (path + query preserved). |
| `ACME_EMAIL` | Let's Encrypt registration email. |

See [`.env.example`](.env.example).

## Deploy

```bash
./automations.sh        # Deploy on this host → deploy: webfinger
```

Or build + run the self-contained artifact:

```bash
./build.sh
scp deploy.sh root@host:
ssh root@host 'bash deploy.sh'
# non-interactive:
#   BASE_DOMAIN=example.com ISSUER_URL=https://auth.example.com \
#   REDIRECT_URL=https://example.org ACME_EMAIL=me@example.com SKIP_PROMPTS=1 bash deploy.sh
```

Unattended provisioning: [`cloud-init.yml`](cloud-init.yml).

## Notes

- Standalone: binds 80/443 itself, so don't co-locate with another stack that
  wants those ports.
- DNS for `BASE_DOMAIN` must resolve to the host and 80/443 be reachable before
  deploy.