57_Wolve
8fbeb8f6b0
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates: AUTO_REBOOT=idle reboots only when no SSH active; opt-in Alpine stable-branch upgrades (ALLOW_RELEASE_UPGRADE) - cloud-init: generic base/jumphost + per-deployment, which harden SSH by default on fresh VMs - pocket-id: optional WebFinger block (BASE_DOMAIN), tag v2.8.0 - headscale: fix oidc.expiry schema for 0.28 so the container starts - Gitea release workflow on tag (TOKEN_GITEA); repo URLs -> Gitea - README/LICENSE/.gitignore/.gitattributes (force LF)
43 lines
1.3 KiB
Caddyfile
43 lines
1.3 KiB
Caddyfile
# Caddyfile for pocket-id stack (base).
|
|
#
|
|
# $POCKETID_DOMAIN pocket-id (via anubis PoW gate)
|
|
#
|
|
# An optional WebFinger site block (Caddyfile.webfinger) is appended by
|
|
# deploy.sh when BASE_DOMAIN is set -- for the case where the base domain has
|
|
# no other web server and you want this Caddy to serve OIDC discovery too.
|
|
# Otherwise use the dedicated `webfinger` deployment.
|
|
{
|
|
email {$ACME_EMAIL}
|
|
# Uncomment for staging certs while testing (avoids LE rate limits):
|
|
# acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Auth: pocket-id behind anubis
|
|
# ----------------------------------------------------------------------------
|
|
{$POCKETID_DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
reverse_proxy anubis-pid:8923 {
|
|
header_up X-Real-IP {remote_host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Forwarded-Host {host}
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
Permissions-Policy "interest-cohort=()"
|
|
-Server
|
|
}
|
|
|
|
log {
|
|
output stdout
|
|
format console
|
|
}
|
|
}
|