mirror of
https://github.com/ScuroNeko/mtg.git
synced 2026-08-31 13:04:02 +03:00
FILE / ScuroNeko/mtg
contrib/sni-router/Caddyfile
Исходный файл и его история в репозитории.
dolonet
170346bb74
Without this, mtg and Caddy see HAProxy's container IP for every connection, which breaks meaningful logging, abuse handling, and any IP-based blocklist logic. HAProxy sends a PROXY protocol v2 header on its TCP backends; mtg enables proxy-protocol-listener, and Caddy wraps :8443 with a proxy_protocol listener before tls. The :80 path (ACME HTTP-01 passthrough) is unchanged — client IP there is not useful and HAProxy's http mode already adds X-Forwarded-For if anyone wants it. Requested in https://github.com/9seconds/mtg/pull/462 review.
31 lines
874 B
Caddyfile
31 lines
874 B
Caddyfile
{
|
|
# Caddy sits behind HAProxy which passes raw TLS through on :8443.
|
|
# ACME HTTP-01 challenges arrive on :80 via HAProxy's acl passthrough.
|
|
http_port 80
|
|
https_port 8443
|
|
|
|
# HAProxy forwards connections to :8443 with a PROXY protocol v2
|
|
# header (see haproxy.cfg `send-proxy-v2`). The proxy_protocol
|
|
# listener wrapper strips the header and exposes the real client IP
|
|
# to Caddy's access log. The `tls` wrapper must follow so that TLS
|
|
# is terminated on the unwrapped connection.
|
|
#
|
|
# `allow` lists the networks permitted to send PROXY headers. These
|
|
# ranges cover docker compose's default bridge networks; tighten
|
|
# them if you pin a specific subnet in docker-compose.yml.
|
|
servers :8443 {
|
|
listener_wrappers {
|
|
proxy_protocol {
|
|
timeout 5s
|
|
allow 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
|
|
}
|
|
tls
|
|
}
|
|
}
|
|
}
|
|
|
|
{$DOMAIN} {
|
|
root * /srv
|
|
file_server
|
|
}
|