vh
454b689a54
svos-dev review: the Caddyfile deleted named headers only. Prefix deletes cover the families; the named strays (Tailscale-Headers-Info, X-Real-IP, Forwarded, X-SVOS-Peer) stay. Wildcard semantics checked on a scratch Caddy (case-insensitive; look-alikes outside the family survive). Deployed, validated via systemd-run with EnvironmentFile, reloaded; deny tests re-run (403). README: safe validate recipe, pending acceptance list.
53 lines
2.2 KiB
Caddyfile
53 lines
2.2 KiB
Caddyfile
# SVOS front door on nh3-svos (eshpfi configs/svos-front/), 2026-10-05. Prime: mesh-only, svos.phasefinal.com.
|
|
# - Listens ONLY on the tailnet address (100.64.0.9:443). There is no LAN or internet listener and no :80 redirect server.
|
|
# - Cert: Let's Encrypt via Cloudflare DNS-01 with a phasefinal.com-only token (env CF_API_TOKEN, /etc/caddy/env).
|
|
# - Identity: every request goes through forward_auth to svos-whois-auth on 127.0.0.1:8405, which resolves the
|
|
# SOCKET peer ({http.request.remote.host}:{port}; no trusted_proxies, so never a client header) with tailscaled
|
|
# WhoIs and returns Tailscale-User-Login only for allow-listed logins. Fail closed (403) otherwise.
|
|
# - Client-supplied identity/forwarding headers are deleted BEFORE auth; the verified login is the only one sent.
|
|
# reverse_proxy sets X-Forwarded-Proto=https and X-Forwarded-For itself; Host passes through; Origin untouched.
|
|
# - App side (svos-dev): kernel 127.0.0.1:8400 (/api/* with the prefix stripped, /api/health is the kernel's),
|
|
# connector 127.0.0.1:8403 (/health, /verbs/ping|pins|pin|unpin, /openapi.json), static UI /opt/svos/current/static.
|
|
{
|
|
email lkraven@lkraven.com
|
|
auto_https disable_redirects
|
|
admin localhost:2019
|
|
}
|
|
|
|
https://svos.phasefinal.com:443 {
|
|
bind 100.64.0.9
|
|
tls {
|
|
dns cloudflare {env.CF_API_TOKEN}
|
|
resolvers 1.1.1.1 8.8.8.8
|
|
}
|
|
route {
|
|
# Whole families by prefix (Caddy header-delete wildcard; tested 2026-10-05: case-insensitive, and
|
|
# X-Forwardedness / Tailscale-Other survive), plus the named strays outside them.
|
|
request_header -Tailscale-User-*
|
|
request_header -X-Forwarded-*
|
|
request_header -Tailscale-Headers-Info
|
|
request_header -X-Real-IP
|
|
request_header -Forwarded
|
|
request_header -X-SVOS-Peer
|
|
|
|
forward_auth 127.0.0.1:8405 {
|
|
uri /auth
|
|
header_up X-SVOS-Peer {http.request.remote.host}:{http.request.remote.port}
|
|
copy_headers Tailscale-User-Login
|
|
}
|
|
|
|
handle_path /api/* {
|
|
reverse_proxy 127.0.0.1:8400
|
|
}
|
|
@connector path /health /verbs/ping /verbs/pins /verbs/pin /verbs/unpin /openapi.json
|
|
handle @connector {
|
|
reverse_proxy 127.0.0.1:8403
|
|
}
|
|
handle {
|
|
root * /opt/svos/current/static
|
|
try_files {path} /index.html
|
|
file_server
|
|
}
|
|
}
|
|
}
|