| 1 | # Caddy in front of Steid. |
| 2 | # |
| 3 | # This is the reference copy, for the manual installation path in README.md. |
| 4 | # install.sh writes the same file to /etc/caddy/Caddyfile with the domain |
| 5 | # substituted — if you change one, change the other. |
| 6 | # |
| 7 | # WHY A PROXY IS MANDATORY, not a nicety: Topcoat 0.5 has no TLS support at all — |
| 8 | # no rustls, no ACME, no HTTPS listener. Steid authenticates git over HTTP Basic, |
| 9 | # so on a plain-HTTP instance a personal access token is sent in cleartext on |
| 10 | # every clone and every push. Caddy is used because obtaining and renewing a |
| 11 | # certificate is automatic and needs no configuration beyond the hostname below. |
| 12 | # |
| 13 | # Requirements for the certificate to issue: the domain's A/AAAA record must |
| 14 | # already point at this machine, and ports 80 and 443 must be reachable. |
| 15 | |
| 16 | git.example.com { |
| 17 | # Steid listens on loopback only (HOST=127.0.0.1 in /etc/steid/steid.env), |
| 18 | # so this proxy is the only way in. |
| 19 | reverse_proxy 127.0.0.1:3000 { |
| 20 | # Git's smart HTTP protocol streams: the client sends ref negotiation and |
| 21 | # waits on a response that is generated as it goes. Buffering either |
| 22 | # direction turns a clone into a long silence and can stall negotiation |
| 23 | # outright, so flush every write straight through. |
| 24 | flush_interval -1 |
| 25 | } |
| 26 | |
| 27 | # Deliberately no `encode`. Git packfiles are already compressed and the git |
| 28 | # client sets its own Accept-Encoding; re-compressing them costs CPU on the |
| 29 | # hot path and buys nothing. |
| 30 | } |