57_Wolve
8fbeb8f6b0
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates: AUTO_REBOOT=idle reboots only when no SSH active; opt-in Alpine stable-branch upgrades (ALLOW_RELEASE_UPGRADE) - cloud-init: generic base/jumphost + per-deployment, which harden SSH by default on fresh VMs - pocket-id: optional WebFinger block (BASE_DOMAIN), tag v2.8.0 - headscale: fix oidc.expiry schema for 0.28 so the container starts - Gitea release workflow on tag (TOKEN_GITEA); repo URLs -> Gitea - README/LICENSE/.gitignore/.gitattributes (force LF)
43 lines
1.2 KiB
Caddyfile
43 lines
1.2 KiB
Caddyfile
|
|
# ----------------------------------------------------------------------------
|
|
# OPTIONAL: appended to the deployed Caddyfile by deploy.sh when BASE_DOMAIN is
|
|
# set. Serves /.well-known/webfinger at the base domain (so Tailscale et al.
|
|
# can discover the OIDC issuer) and redirects everything else to $REDIRECT_URL.
|
|
# Needs BASE_DOMAIN + REDIRECT_URL in .env (passed to caddy via compose).
|
|
# ----------------------------------------------------------------------------
|
|
{$BASE_DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
@webfinger path /.well-known/webfinger
|
|
handle @webfinger {
|
|
header Content-Type "application/jrd+json"
|
|
header Cache-Control "public, max-age=3600"
|
|
templates
|
|
respond `{
|
|
"subject": "{{.Req.URL.Query.Get "resource"}}",
|
|
"links": [
|
|
{
|
|
"rel": "http://openid.net/specs/connect/1.0/issuer",
|
|
"href": "https://{$POCKETID_DOMAIN}"
|
|
}
|
|
]
|
|
}` 200
|
|
}
|
|
|
|
handle {
|
|
redir {$REDIRECT_URL}{uri} permanent
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
-Server
|
|
}
|
|
|
|
log {
|
|
output stdout
|
|
format console
|
|
}
|
|
}
|