70 lines
2.2 KiB
Markdown
70 lines
2.2 KiB
Markdown
# Caddy — ingress, local CDN, landing page
|
|
|
|
## Summary
|
|
|
|
Single HTTP ingress for the stack. Three roles:
|
|
1. **Reverse proxy** — `auth.ulicraft.local` → drasl.
|
|
2. **Local CDN / static** — `packwiz.ulicraft.local` serves pack metadata AND the
|
|
mirrored mod jars (offline installs).
|
|
3. **Landing page** — apex `ulicraft.local` serves launcher downloads + guest guide.
|
|
|
|
Plain `:80` for now (LAN). TLS via step-ca deferred. Image: `caddy:alpine`.
|
|
Caddy natively reads `{$BASE_DOMAIN}` env placeholders — no template render needed.
|
|
|
|
## Network aliases (internal resolution)
|
|
|
|
```yaml
|
|
caddy:
|
|
networks:
|
|
mcnet:
|
|
aliases:
|
|
- "auth.${BASE_DOMAIN}"
|
|
- "packwiz.${BASE_DOMAIN}"
|
|
```
|
|
Lets `minecraft` reach `http://auth.ulicraft.local/authlib-injector` and
|
|
`http://packwiz.ulicraft.local/pack.toml` without dnsmasq.
|
|
|
|
## Caddyfile sketch
|
|
|
|
```
|
|
{
|
|
auto_https off
|
|
}
|
|
|
|
http://{$BASE_DOMAIN} {
|
|
root * /srv/www
|
|
file_server
|
|
}
|
|
|
|
http://auth.{$BASE_DOMAIN} {
|
|
reverse_proxy drasl:25585
|
|
}
|
|
|
|
http://packwiz.{$BASE_DOMAIN} {
|
|
root * /srv/pack
|
|
file_server browse
|
|
}
|
|
```
|
|
|
|
Mounts: `./www:/srv/www:ro`, `./pack:/srv/pack:ro`, `./mirror/launcher:/srv/www/launcher:ro`.
|
|
|
|
## Notes / risks
|
|
|
|
- drasl behind a proxy: docs don't detail `X-Forwarded-*` trust. On plain HTTP LAN
|
|
with matching `BaseURL` it should be fine; revisit when TLS is added.
|
|
- `file_server browse` gives a directory listing — handy for debugging the pack.
|
|
- Mod-jar mirror lives under `/srv/pack/mods/` so packwiz URLs and jars share host.
|
|
|
|
## Tasks
|
|
|
|
- [ ] Add `caddy` service to `docker-compose.yml`, ports `80:80` (+`443` later)
|
|
- [ ] Pass `BASE_DOMAIN` into caddy env
|
|
- [ ] Create `caddy/Caddyfile` with apex + auth + packwiz vhosts
|
|
- [ ] Add network aliases for `auth.` and `packwiz.` subdomains
|
|
- [ ] Mount `./www`, `./pack`, `./mirror/launcher`
|
|
- [ ] Confirm reverse_proxy to drasl works (auth web UI loads, Yggdrasil API responds)
|
|
- [ ] Verify internal alias resolution from `minecraft` container (curl pack.toml)
|
|
- [ ] Air-gap mirror: add per-host `tls internal` vhosts + aliases + mounts (see 11)
|
|
- [ ] Export Caddy root CA for guest trust (LAN-party TLS = `tls internal`; step-ca deferred)
|
|
- [ ] Defer (reminder): graduate `tls internal` → step-ca for persistent homelab
|