From 4fedc80bb421b4a402431c180d87a33cf8556c1f Mon Sep 17 00:00:00 2001 From: Erik Simon Date: Mon, 20 Jul 2026 08:24:35 +0200 Subject: [PATCH] neptun: serve the vhosts that are actually in production Probing the live Debian VPS turned up three mismatches between what it serves and what this config declares: - git.mgaction.town had no vhost at all. Gitea's web UI and HTTPS clones are public today; only its SSH side (the :2222 socat forward) had been ported, so a deploy would have taken the web side offline. - Audiobookshelf is served as abs.mgaction.town, not the longer audiobookshelf.mgaction.town this config used. The mobile app is configured with the short name. - The apex returns 200 from Caddy. Left unserved deliberately, so it now gets Caddy's default 404; noted in a comment so it doesn't look like an oversight next time. Gitea's ROOT_URL was http:// while Caddy terminates TLS for that name. Gitea builds absolute URLs from it, so clone buttons, redirects and webhooks were handing out downgraded links. Also record that defaultGateway6 is confirmed rather than assumed -- `ip -6 route show default` on the VPS gives "default via fe80::1 dev eth0 metric 1024 onlink". Co-Authored-By: Claude Opus 4.8 --- hosts/neptun/configuration.nix | 24 +++++++++++++++++------- services/dev/gitea.nix | 5 ++++- 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/hosts/neptun/configuration.nix b/hosts/neptun/configuration.nix index d89b349..d24434e 100644 --- a/hosts/neptun/configuration.nix +++ b/hosts/neptun/configuration.nix @@ -38,8 +38,8 @@ ipv6.addresses = [ { address = "2a0a:4cc0:c2:19e1:44b4:8dff:fe4d:c7d7"; prefixLength = 64; } ]; }; networking.defaultGateway = { address = "159.195.64.1"; interface = "eth0"; }; - # netcup IPv6 gateway is conventionally fe80::1 — VERIFY with `ip -6 route` - # on the running VPS; wrong v6 gw won't break v4 reachability. + # Confirmed against `ip -6 route show default` on the VPS: + # default via fe80::1 dev eth0 metric 1024 onlink networking.defaultGateway6 = { address = "fe80::1"; interface = "eth0"; }; networking.nameservers = [ "9.9.9.9" "1.1.1.1" "2620:fe::fe" ]; @@ -69,13 +69,23 @@ services.caddy.globalConfig = "email {$ACME_EMAIL}"; # ---- Public reverse proxy vhosts ---- - # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains. - # Proxies to jupiter's audiobookshelf over the tailnet (MagicDNS name). - # Needs a public A record -> this VPS IP (ports 80/443 opened by the module). - services.caddy.virtualHosts."audiobookshelf.mgaction.town".extraConfig = '' + # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains; the + # *.mgaction.town wildcard already points every name here (A + AAAA), and + # the module opens 80/443. Both of these live on jupiter and are reached + # over the tailnet — see the /etc/hosts pin above. + # + # `abs`, not `audiobookshelf`: that's the name this has always been served + # under, and the mobile app is configured with it. + services.caddy.virtualHosts."abs.mgaction.town".extraConfig = '' reverse_proxy http://jupiter.hosts.mgaction.town:8000 ''; - # TODO: port your other VPS services' vhosts here before deploying. + # Gitea's web UI and HTTPS clones (services/dev/gitea.nix, HTTP_PORT 3000). + # Its SSH side is the separate :2222 forward further down. + services.caddy.virtualHosts."git.mgaction.town".extraConfig = '' + reverse_proxy http://jupiter.hosts.mgaction.town:3000 + ''; + # The apex mgaction.town is deliberately not served — it returns Caddy's + # default 404. # ---- Authentik (identity/OIDC provider) ---- # Runs locally on neptun (see services/identity/authentik.nix); Caddy just diff --git a/services/dev/gitea.nix b/services/dev/gitea.nix index 4423c45..510fe95 100644 --- a/services/dev/gitea.nix +++ b/services/dev/gitea.nix @@ -22,7 +22,10 @@ server = { DOMAIN = "git.mgaction.town"; SSH_DOMAIN = "git.mgaction.town"; - ROOT_URL = "http://git.mgaction.town/"; + # https, not http: neptun's Caddy terminates TLS for this name. Gitea + # builds its absolute URLs (clone buttons, redirects, webhooks) from + # ROOT_URL, so an http:// value hands out downgraded links. + ROOT_URL = "https://git.mgaction.town/"; HTTP_PORT = 3000; START_SSH_SERVER = true; SSH_PORT = 2222;