42 lines
1.4 KiB
Caddyfile
42 lines
1.4 KiB
Caddyfile
# HTTPS on this server's own address in the local network (no domain): Caddy signs the
|
||
# certificate itself (its own small certificate authority, kept in the caddy-data volume) and
|
||
# renews it by itself. setup.sh 「區網 IP」 writes this with LAN_IP replaced by the address.
|
||
#
|
||
# Each phone and computer trusts that authority once: open http://LAN_IP/anybot-ca.crt and
|
||
# install it (iPhone: then 設定 › 一般 › 關於本機 › 憑證信任設定, turn it on). After that the
|
||
# browser and AnyBot connect to https://LAN_IP without warnings.
|
||
{
|
||
# A browser asking for an IP address doesn't say which name it wants (no SNI).
|
||
default_sni LAN_IP
|
||
# The authority lives in this container only; nothing is installed on the server itself.
|
||
skip_install_trust
|
||
}
|
||
|
||
https://LAN_IP {
|
||
tls internal
|
||
encode gzip
|
||
reverse_proxy relay:8080 {
|
||
# The phone's "anything new?" request waits up to 35 s. Each AnyBot also keeps one
|
||
# WebSocket open here (pinged every 15–20 s, so it never sits idle for 60 s).
|
||
transport http {
|
||
read_timeout 60s
|
||
}
|
||
# Reloading this file doesn't cut those connections at once.
|
||
stream_close_delay 5m
|
||
}
|
||
}
|
||
|
||
# Plain http only hands out the certificate to trust (it's public anyway), and sends
|
||
# everything else to https.
|
||
http://LAN_IP {
|
||
handle /anybot-ca.crt {
|
||
root * /data/caddy/pki/authorities/local
|
||
rewrite * /root.crt
|
||
header Content-Type application/x-x509-ca-cert
|
||
file_server
|
||
}
|
||
handle {
|
||
redir https://LAN_IP{uri}
|
||
}
|
||
}
|