grabowski
560d073019
Deploy test site / deploy (push) Canceled after 0s
site/ builds the internal test site: public/ served as is (landing page, robots.txt, static sites) plus demo pages copied out of docs/ (the plant operation page at /demos/plant-operation/). build.sh fails on dead internal links and stamps version.txt. .gitea/workflows/deploy-site.yml rsyncs site/dist to the buildfor.life web server with the blog's two-directory rename swap, checks version.txt on the server, purges Cloudflare when a token is set, and checks the public URL. Secret names match the blog's workflow. site/Caddyfile is the virtual host to append on s1 (noindex everywhere, Cloudflare-only like the blog apex, www redirect). site/README.md has the one-time setup: DNS, Caddy, web root, secrets, runner.
41 lines
1.4 KiB
Caddyfile
41 lines
1.4 KiB
Caddyfile
# cnxvinyl.lol: internal test site on the buildfor.life web server (s1).
|
|
# Static web root /var/www/cnxvinyl.lol, filled by
|
|
# .gitea/workflows/deploy-site.yml in the cnx_vinyl repo.
|
|
#
|
|
# Append these blocks to /etc/caddy/Caddyfile on s1. They reuse the
|
|
# cloudflare_only and security_headers snippets defined there for
|
|
# buildfor.life (buildfor_life_web: infra/caddy/Caddyfile.example); if
|
|
# they are missing, validate fails with "File to import not found:
|
|
# cloudflare_only" and they have to be copied in from the example first.
|
|
# caddy validate --config /etc/caddy/Caddyfile
|
|
# systemctl reload caddy
|
|
#
|
|
# Cloudflare: both names proxied (orange cloud), SSL/TLS mode "Full (strict)".
|
|
# "Flexible" sends plain HTTP to Caddy, which redirects to HTTPS: a loop.
|
|
# Same rule as the buildfor.life apex: if a record is ever switched to DNS
|
|
# only, remove "import cloudflare_only" first or that name goes dark.
|
|
|
|
cnxvinyl.lol {
|
|
import cloudflare_only
|
|
import security_headers
|
|
header X-Frame-Options "SAMEORIGIN"
|
|
# Internal testing: keep every page and file out of search engines.
|
|
header X-Robots-Tag "noindex, nofollow"
|
|
|
|
# Optional login for the whole site. Make the hash on s1 with
|
|
# caddy hash-password
|
|
# then uncomment and fill in:
|
|
# basic_auth {
|
|
# <user> <hash>
|
|
# }
|
|
|
|
root * /var/www/cnxvinyl.lol
|
|
encode zstd gzip
|
|
file_server
|
|
}
|
|
|
|
www.cnxvinyl.lol {
|
|
import cloudflare_only
|
|
redir https://cnxvinyl.lol{uri} permanent
|
|
}
|