42 lines
1.4 KiB
Caddyfile
42 lines
1.4 KiB
Caddyfile
|
# HTTPS on this server's own address in the local network (no domain): Caddy signs the
|
|||
|
|
# certificate itself (its own small certificate authority, kept in the caddy-data volume) and
|
|||
|
|
# renews it by itself. setup.sh 「區網 IP」 writes this with LAN_IP replaced by the address.
|
|||
|
|
#
|
|||
|
|
# Each phone and computer trusts that authority once: open http://LAN_IP/anybot-ca.crt and
|
|||
|
|
# install it (iPhone: then 設定 › 一般 › 關於本機 › 憑證信任設定, turn it on). After that the
|
|||
|
|
# browser and AnyBot connect to https://LAN_IP without warnings.
|
|||
|
|
{
|
|||
|
|
# A browser asking for an IP address doesn't say which name it wants (no SNI).
|
|||
|
|
default_sni LAN_IP
|
|||
|
|
# The authority lives in this container only; nothing is installed on the server itself.
|
|||
|
|
skip_install_trust
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
https://LAN_IP {
|
|||
|
|
tls internal
|
|||
|
|
encode gzip
|
|||
|
|
reverse_proxy relay:8080 {
|
|||
|
|
# The phone's "anything new?" request waits up to 35 s. Each AnyBot also keeps one
|
|||
|
|
# WebSocket open here (pinged every 15–20 s, so it never sits idle for 60 s).
|
|||
|
|
transport http {
|
|||
|
|
read_timeout 60s
|
|||
|
|
}
|
|||
|
|
# Reloading this file doesn't cut those connections at once.
|
|||
|
|
stream_close_delay 5m
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# Plain http only hands out the certificate to trust (it's public anyway), and sends
|
|||
|
|
# everything else to https.
|
|||
|
|
http://LAN_IP {
|
|||
|
|
handle /anybot-ca.crt {
|
|||
|
|
root * /data/caddy/pki/authorities/local
|
|||
|
|
rewrite * /root.crt
|
|||
|
|
header Content-Type application/x-x509-ca-cert
|
|||
|
|
file_server
|
|||
|
|
}
|
|||
|
|
handle {
|
|||
|
|
redir https://LAN_IP{uri}
|
|||
|
|
}
|
|||
|
|
}
|