blob: c86f4e567e45904887585de3c6fa6daa46e8a9f1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
# Web frontend routing inside the bokf-web container: the login gate
# (bokfweb, 127.0.0.1:7682) and the browser terminal (ttyd, 127.0.0.1:7681).
# Nothing reaches ttyd without the gate's OK.
#
# Plain HTTP on :8790, published on the host's loopback only. TLS for
# https://bokf.makandra.eu is the host's reverse proxy (the NAS Caddy):
#
# bokf.makandra.eu {
# tls { dns inwx ... } # as for the other sites
# reverse_proxy 127.0.0.1:8790
# }
{
auto_https off
admin off
servers {
# the host proxy's X-Forwarded-For names the real client (the
# gate limits failed logins per client address)
trusted_proxies static private_ranges
}
}
:8790 {
header {
Strict-Transport-Security "max-age=31536000"
-Server
}
redir / /web/ 302
# the terminal: only with a live login whose handle is in the URL
@tty path /web/tty /web/tty/*
handle @tty {
forward_auth 127.0.0.1:7682 {
uri /auth
}
reverse_proxy 127.0.0.1:7681
}
# login page, login and logout
handle /web* {
reverse_proxy 127.0.0.1:7682
}
handle {
respond "not found" 404
}
}
|
