1 files changed, 47 insertions, 0 deletions
diff --git a/deploy/Caddyfile b/deploy/Caddyfile
new file mode 100644
index 0000000..c86f4e5
--- /dev/null
+++ b/deploy/Caddyfile
@@ -0,0 +1,47 @@
+# Web frontend routing inside the bokf-web container: the login gate
+# (bokfweb, 127.0.0.1:7682) and the browser terminal (ttyd, 127.0.0.1:7681).
+# Nothing reaches ttyd without the gate's OK.
+#
+# Plain HTTP on :8790, published on the host's loopback only. TLS for
+# https://bokf.makandra.eu is the host's reverse proxy (the NAS Caddy):
+#
+#     bokf.makandra.eu {
+#         tls { dns inwx ... }          # as for the other sites
+#         reverse_proxy 127.0.0.1:8790
+#     }
+{
+	auto_https off
+	admin off
+	servers {
+		# the host proxy's X-Forwarded-For names the real client (the
+		# gate limits failed logins per client address)
+		trusted_proxies static private_ranges
+	}
+}
+
+:8790 {
+	header {
+		Strict-Transport-Security "max-age=31536000"
+		-Server
+	}
+
+	redir / /web/ 302
+
+	# the terminal: only with a live login whose handle is in the URL
+	@tty path /web/tty /web/tty/*
+	handle @tty {
+		forward_auth 127.0.0.1:7682 {
+			uri /auth
+		}
+		reverse_proxy 127.0.0.1:7681
+	}
+
+	# login page, login and logout
+	handle /web* {
+		reverse_proxy 127.0.0.1:7682
+	}
+
+	handle {
+		respond "not found" 404
+	}
+}