| 1 | # Caddy in front of Steid. |
| 2 | # |
| 3 | # This is the reference copy, for the manual installation path in README.md. |
| 4 | # install.sh writes the same file to /etc/caddy/Caddyfile with the domain |
| 5 | # substituted — if you change one, change the other. |
| 6 | # |
| 7 | # WHY A PROXY IS MANDATORY, not a nicety: Topcoat 0.5 has no TLS support at all — |
| 8 | # no rustls, no ACME, no HTTPS listener. Steid authenticates git over HTTP Basic, |
| 9 | # so on a plain-HTTP instance a personal access token is sent in cleartext on |
| 10 | # every clone and every push. Caddy is used because obtaining and renewing a |
| 11 | # certificate is automatic and needs no configuration beyond the hostname below. |
| 12 | # |
| 13 | # Requirements for the certificate to issue: the domain's A/AAAA record must |
| 14 | # already point at this machine, and ports 80 and 443 must be reachable. |
| 15 | |
| 16 | git.example.com { |
| 17 | # Steid listens on loopback only (HOST=127.0.0.1 in /etc/steid/steid.env), |
| 18 | # so this proxy is the only way in. |
| 19 | reverse_proxy 127.0.0.1:3000 { |
| 20 | # Git's smart HTTP protocol streams: the client sends ref negotiation and |
| 21 | # waits on a response that is generated as it goes. Buffering either |
| 22 | # direction turns a clone into a long silence and can stall negotiation |
| 23 | # outright, so flush every write straight through. |
| 24 | flush_interval -1 |
| 25 | } |
| 26 | |
| 27 | # Deliberately no `encode`. Git packfiles are already compressed and the git |
| 28 | # client sets its own Accept-Encoding; re-compressing them costs CPU on the |
| 29 | # hot path and buys nothing. |
| 30 | } |
| 31 | |
| 32 | # --- OPTIONAL: only on the instance that DISTRIBUTES Steid ------------------- |
| 33 | # |
| 34 | # Most people running Steid do not want this. It belongs on the one instance that |
| 35 | # publishes releases for everyone else — the host baked into install.sh as |
| 36 | # RELEASE_BASE_URL. Uncomment the two `handle` blocks below and move the |
| 37 | # `reverse_proxy` into a trailing `handle { … }` so the static paths win first. |
| 38 | # |
| 39 | # handle /jamesgill/repos/steid/releases/* { |
| 40 | # root * /var/lib/steid/dist |
| 41 | # file_server |
| 42 | # } |
| 43 | # handle /install.sh { |
| 44 | # root * /var/lib/steid/dist |
| 45 | # file_server |
| 46 | # } |
| 47 | # handle { |
| 48 | # reverse_proxy 127.0.0.1:3000 { flush_interval -1 } |
| 49 | # } |
| 50 | # |
| 51 | # Two things to know, and the first one bites later: |
| 52 | # |
| 53 | # 1. THESE PATHS SHADOW STEID. Caddy answers them before the application sees |
| 54 | # them. Nothing lives at /{handle}/repos/{name}/releases today, so nothing |
| 55 | # breaks — but the day Steid grows a real release feature at that URL, Caddy |
| 56 | # silently keeps winning and the feature will look broken. Delete these blocks |
| 57 | # then. The URL is deliberately the one that feature will use, so links |
| 58 | # published now survive the change. |
| 59 | # |
| 60 | # 2. /install.sh at the root is safe permanently, not by luck: OrgName allows |
| 61 | # only [a-z0-9-], so no handle can ever contain a dot and none can collide |
| 62 | # with it. A root-level /releases would NOT be safe for the same reason — it |
| 63 | # is a valid handle shape — which is why the releases path is scoped. |
| 64 | # |
| 65 | # Artefacts are rsync'd into /var/lib/steid/dist/v<version>/ to match the URL |
| 66 | # install.sh builds: ${RELEASE_BASE_URL}/v${VERSION}/steid-<version>-<target>.tar.gz |