57_Wolve
7faa9098de
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and opt-in Alpine stable-branch upgrades - generic + per-deployment cloud-init; Gitea release workflow on tag - README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea
37 lines
909 B
Caddyfile
37 lines
909 B
Caddyfile
# Caddyfile for headscale stack.
|
|
#
|
|
# Auto-issues a Let's Encrypt cert for $HEADSCALE_DOMAIN and reverse-proxies
|
|
# to headscale's HTTP listener on :8080. Tailscale clients require this
|
|
# exact hostname over HTTPS.
|
|
{
|
|
email {$ACME_EMAIL}
|
|
}
|
|
|
|
{$HEADSCALE_DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
reverse_proxy headscale:8080 {
|
|
header_up X-Real-IP {http.request.remote.host}
|
|
# Long-lived noise/wireguard control streams; lift the default
|
|
# idle limit so they don't get torn down.
|
|
flush_interval -1
|
|
transport http {
|
|
read_timeout 10m
|
|
write_timeout 10m
|
|
}
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
-Server
|
|
}
|
|
|
|
log {
|
|
output stdout
|
|
format console
|
|
}
|
|
}
|