maxfield
d65402be91
Remote edge nodes pull origins/rules/edge IPs with ess_ site bearers (KD-15) instead of the shared CADDY_EDGE_API_KEY. Bundle supports ETag 304 and since, optional HMAC response sig, and soft-deps empty rules when EdgeRules is absent. First-class edge role enables web with mail and authority off; compose and pure-edge Caddyfile examples included.
60 lines
1.8 KiB
Text
60 lines
1.8 KiB
Text
# Pure-edge Caddyfile — reverse-proxies to an edge-facing Elektrine node.
|
|
#
|
|
# Unlike the product Caddyfiles, this variant intentionally forwards /_edge/*
|
|
# (config pull target is usually the control plane; tunnel WSS + proxy live
|
|
# here). Use with ELEKTRINE_RUNTIME_ROLE=edge (or app + ELEKTRINE_ENABLE_WEB=true).
|
|
#
|
|
# Optional multi-node HTTP cache: stock Caddy 2.11.x has no cache module.
|
|
# Named choice when operators build a custom image (not enabled by default):
|
|
# github.com/caddyserver/cache-handler (Souin-backed, v0.16.x line for Caddy 2.8+)
|
|
# Pin a release and rebuild via xcaddy; do not claim multi-node cache until
|
|
# purge fan-out is configured against each site bearer.
|
|
#
|
|
# Env:
|
|
# ACME_EMAIL, CADDY_ASK_URL (control-plane or local /_edge/tls/v1/allow)
|
|
# ORIGIN_UPSTREAM — edge app, e.g. edge:8080
|
|
# CADDY_TRUSTED_PROXY_CIDRS, NETBIRD_ALLOWED_CIDRS
|
|
|
|
{
|
|
email {$ACME_EMAIL:admin@example.com}
|
|
storage file_system /data/caddy
|
|
|
|
on_demand_tls {
|
|
ask {$CADDY_ASK_URL}
|
|
}
|
|
|
|
auto_https disable_redirects
|
|
|
|
servers :443 {
|
|
trusted_proxies static 192.0.2.0/32 {$CADDY_TRUSTED_PROXY_CIDRS:}
|
|
trusted_proxies_strict
|
|
client_ip_headers X-Forwarded-For X-Real-IP
|
|
}
|
|
|
|
servers :80 {
|
|
trusted_proxies static 192.0.2.0/32 {$CADDY_TRUSTED_PROXY_CIDRS:}
|
|
trusted_proxies_strict
|
|
client_ip_headers X-Forwarded-For X-Real-IP
|
|
}
|
|
}
|
|
|
|
https:// {
|
|
tls {
|
|
on_demand
|
|
}
|
|
|
|
header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
|
|
|
|
# Pure-edge: do NOT 404 /_edge/* — tunnel WSS, access complete, and local
|
|
# edge APIs must reach the Phoenix endpoint.
|
|
reverse_proxy {$ORIGIN_UPSTREAM:edge:8080} {
|
|
header_up Host {host}
|
|
header_up X-Forwarded-Proto https
|
|
header_up X-Forwarded-For {client_ip}
|
|
header_up X-Real-IP {client_ip}
|
|
}
|
|
}
|
|
|
|
:80 {
|
|
redir https://{host}{uri} 308
|
|
}
|