feat(nh3-svos): mesh-only front door for svos.phasefinal.com (Caddy + WhoIs fail-closed auth), headscale extra record

2026-10-05 19:31:41 -07:00
parent 63736bd40a
commit ce398685c0
5 changed files with 230 additions and 1 deletions
@@ -0,0 +1,54 @@
+# SVOS front door on nh3-svos (eshpfi configs/svos-front/), 2026-10-05. Prime: mesh-only, svos.phasefinal.com.
+# - Listens ONLY on the tailnet address (100.64.0.9:443). There is no LAN or internet listener and no :80 redirect server.
+# - Cert: Let's Encrypt via Cloudflare DNS-01 with a phasefinal.com-only token (env CF_API_TOKEN, /etc/caddy/env).
+# - Identity: every request goes through forward_auth to svos-whois-auth on 127.0.0.1:8405, which resolves the
+#   SOCKET peer ({http.request.remote.host}:{port}; no trusted_proxies, so never a client header) with tailscaled
+#   WhoIs and returns Tailscale-User-Login only for allow-listed logins. Fail closed (403) otherwise.
+# - Client-supplied identity/forwarding headers are deleted BEFORE auth; the verified login is the only one sent.
+#   reverse_proxy sets X-Forwarded-Proto=https and X-Forwarded-For itself; Host passes through; Origin untouched.
+# - App side (svos-dev): kernel 127.0.0.1:8400 (/api/* with the prefix stripped, /api/health is the kernel's),
+#   connector 127.0.0.1:8403 (/health, /verbs/ping|pins|pin|unpin, /openapi.json), static UI /opt/svos/current/static.
+{
+	email lkraven@lkraven.com
+	auto_https disable_redirects
+	admin localhost:2019
+}
+
+https://svos.phasefinal.com:443 {
+	bind 100.64.0.9
+	tls {
+		dns cloudflare {env.CF_API_TOKEN}
+		resolvers 1.1.1.1 8.8.8.8
+	}
+	route {
+		request_header -Tailscale-User-Login
+		request_header -Tailscale-User-Name
+		request_header -Tailscale-User-Profile-Pic
+		request_header -Tailscale-Headers-Info
+		request_header -X-Forwarded-For
+		request_header -X-Forwarded-Proto
+		request_header -X-Forwarded-Host
+		request_header -X-Real-IP
+		request_header -Forwarded
+		request_header -X-SVOS-Peer
+
+		forward_auth 127.0.0.1:8405 {
+			uri /auth
+			header_up X-SVOS-Peer {http.request.remote.host}:{http.request.remote.port}
+			copy_headers Tailscale-User-Login
+		}
+
+		handle_path /api/* {
+			reverse_proxy 127.0.0.1:8400
+		}
+		@connector path /health /verbs/ping /verbs/pins /verbs/pin /verbs/unpin /openapi.json
+		handle @connector {
+			reverse_proxy 127.0.0.1:8403
+		}
+		handle {
+			root * /opt/svos/current/static
+			try_files {path} /index.html
+			file_server
+		}
+	}
+}