57_WolveandClaude Opus 5
237aa913f0
.env was written only on the first run. All four values reach Caddy solely
through compose interpolating .env into the container environment -- the
Caddyfile is installed verbatim every run and carries Caddy's own
{$ISSUER_URL} / {$BASE_DOMAIN} / {$REDIRECT_URL} / {$ACME_EMAIL} placeholders,
resolved at config load. So .env is the only thing that decides what is served.
Both paths were wrong. Interactively, the prompts are required and have no
default, so a re-run made the operator retype all four -- and then discarded
every one, because a value read into a nameref is not exported and .env was
not rewritten. Via automations.sh the values ARE exported, so compose
preferred them for that run only and the documented later
`docker compose up -d` reverted to stale .env.
Either way the run exits 0 and the DEPLOYED banner prints this shell's
values, not what was deployed. Moving the IdP from auth.example.com to
id.example.com leaves the endpoint serving "href": the old issuer, pointing
every discovering client at a decommissioned issuer, with the deploy that was
meant to fix it reporting success.
Same shape as d654299: record which keys arrived in the environment before the
":=" defaults, pre-load .env into keys not passed so the prompts stop
demanding a full retype (and SKIP_PROMPTS=1 no longer dies over values .env
already has), then write only the passed keys through with set_env.
Verified: a corrected ISSUER_URL containing a & query string lands in .env
intact (the old escaping would have corrupted it); a re-run passing nothing
leaves .env byte-identical and does not die.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
webfinger
A single Caddy container that serves /.well-known/webfinger at an apex domain
(for OIDC issuer discovery — used by Tailscale and others) and 301-redirects
everything else to a target URL.
Required .env values
| Variable | Notes |
|---|---|
BASE_DOMAIN |
Apex domain to serve from (e.g. example.com). |
ISSUER_URL |
OIDC issuer for the WebFinger response (your pocket-id). |
REDIRECT_URL |
Where non-WebFinger traffic is redirected (path + query preserved). |
ACME_EMAIL |
Let's Encrypt registration email. |
See .env.example.
Deploy
./automations.sh # Deploy on this host → deploy: webfinger
Or build + run the self-contained artifact:
./build.sh
scp deploy.sh root@host:
ssh root@host 'bash deploy.sh'
# non-interactive:
# BASE_DOMAIN=example.com ISSUER_URL=https://auth.example.com \
# REDIRECT_URL=https://example.org ACME_EMAIL=me@example.com SKIP_PROMPTS=1 bash deploy.sh
Unattended provisioning: cloud-init.yml.
Notes
- Standalone: binds 80/443 itself, so don't co-locate with another stack that wants those ports.
- DNS for
BASE_DOMAINmust resolve to the host and 80/443 be reachable before deploy.