32 lines
1007 B
Caddyfile
32 lines
1007 B
Caddyfile
# auto_https off would disable TLS entirely, breaking `tls internal` for the
|
|
# air-gap mirror vhosts. disable_redirects keeps the apex/auth/packwiz sites
|
|
# plaintext on :80 (they use explicit http://) while still allowing internal
|
|
# TLS on the mirror hosts below.
|
|
{
|
|
auto_https disable_redirects
|
|
}
|
|
|
|
http://{$BASE_DOMAIN} {
|
|
root * /srv/www
|
|
file_server
|
|
}
|
|
|
|
http://auth.{$BASE_DOMAIN} {
|
|
reverse_proxy drasl:25585
|
|
}
|
|
|
|
http://packwiz.{$BASE_DOMAIN} {
|
|
root * /srv/pack
|
|
file_server browse
|
|
}
|
|
|
|
# Full client air-gap mirror (see plan/11-full-airgap-mirror.md): byte-exact
|
|
# copies of the real upstream hosts served over HTTPS with Caddy's local CA.
|
|
# dnsmasq spoofs these hostnames -> our host; the {host} placeholder roots each
|
|
# hostname at its own mirror subtree. Guests import the Caddy root CA once.
|
|
meta.prismlauncher.org, piston-meta.mojang.com, piston-data.mojang.com, libraries.minecraft.net, maven.neoforged.net, resources.download.minecraft.net {
|
|
tls internal
|
|
root * /srv/mirror/{host}
|
|
file_server
|
|
}
|