Erich Blume
b197bd5f58
## Summary Migrates the docs build pipeline to Dagger (Phase 2 of the Dagger CI adoption plan). - **Backfill `date-modified` frontmatter** on all 80 docs — Dagger's `--src=.` excludes `.git`, so Quartz can't use git history for page dates. Frontmatter dates work with or without git. - **New `docs-check-frontmatter` mise task + pre-commit hook** — validates all docs have `title`, `tags`, and `date-modified` - **New Dagger functions** — `build_changelog` (towncrier in Python container) and `build_docs` (chains changelog → Quartz build in Node container, returns tarball) - **Simplified CI workflow** — the ~44-line inline Quartz build (clone, npm ci, build, tar, cleanup) is replaced by `dagger call build-docs`. Changelog step remains local on the runner since towncrier needs to modify the host working tree for the git commit. ### Design decisions - **Towncrier runs twice in CI**: once inside Dagger (for the docs tarball) and once on the runner (for the git commit). This is intentional — Dagger's directory export is additive and can't delete the consumed changelog fragments from the host. - **Artifact hosting stays on Forgejo Releases** (not migrated to Forgejo Packages as the plan doc originally suggested). That migration can happen independently. - **`date-modified` frontmatter** preserved even though `build_changelog` installs git — the git there is only for towncrier's `git add` call, not for history. The local iteration story (`dagger call build-docs --src=. --version=dev` with uncommitted changes) depends on frontmatter dates. ### Local iteration ```bash dagger call build-docs --src=. --version=dev export --path=./docs-dev.tar.gz tar tf docs-dev.tar.gz | head -20 ``` ## Deployment and Testing - [x] `dagger call build-docs --src=. --version=dev` produces valid 1.1MB tarball (149 HTML pages) - [x] Pre-commit hooks pass (including new `docs-check-frontmatter`) - [ ] Full `workflow_dispatch` run after merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/157
104 lines
3.2 KiB
Markdown
104 lines
3.2 KiB
Markdown
---
|
|
title: Caddy
|
|
date-modified: 2026-02-08
|
|
tags:
|
|
- service
|
|
- networking
|
|
- tls
|
|
---
|
|
|
|
# Caddy
|
|
|
|
Reverse proxy for `*.ops.eblu.me` services with automatic TLS via ACME DNS-01.
|
|
|
|
## Quick Reference
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **Domain** | `*.ops.eblu.me` |
|
|
| **HTTPS Port** | 443 |
|
|
| **Config** | `ansible/roles/caddy/templates/Caddyfile.j2` |
|
|
| **Binary** | Custom build with Gandi DNS plugin |
|
|
|
|
## Why Caddy?
|
|
|
|
Caddy provides a single TLS termination point for all BlumeOps services:
|
|
|
|
- **Wildcard certificate** for `*.ops.eblu.me` via Let's Encrypt
|
|
- **DNS-01 challenge** using Gandi API (no port 80 needed)
|
|
- **Unified access** from k8s pods, containers, and tailnet clients
|
|
|
|
See [[routing]] for when to use `*.ops.eblu.me` vs `*.tail8d86e.ts.net`.
|
|
|
|
## Proxied Services
|
|
|
|
### Indri-Local Services
|
|
|
|
| Subdomain | Backend | Service |
|
|
|-----------|---------|---------|
|
|
| `forge.ops.eblu.me` | `localhost:3001` | [[forgejo]] |
|
|
| `registry.ops.eblu.me` | `localhost:5050` | [[zot]] |
|
|
| `jellyfin.ops.eblu.me` | `localhost:8096` | [[jellyfin]] |
|
|
|
|
### Kubernetes Services
|
|
|
|
K8s services are proxied via their Tailscale Ingress endpoints:
|
|
|
|
| Subdomain | Backend | Service |
|
|
|-----------|---------|---------|
|
|
| `grafana.ops.eblu.me` | `grafana.tail8d86e.ts.net` | [[grafana]] |
|
|
| `argocd.ops.eblu.me` | `argocd.tail8d86e.ts.net` | [[argocd]] |
|
|
| `docs.ops.eblu.me` | `docs.tail8d86e.ts.net` | [[docs]] (now publicly available at `docs.eblu.me` via [[flyio-proxy]]) |
|
|
| `feed.ops.eblu.me` | `feed.tail8d86e.ts.net` | [[miniflux]] |
|
|
| ... | ... | (see defaults/main.yml for full list) |
|
|
|
|
### TCP Services (Layer 4)
|
|
|
|
| Port | Backend | Service |
|
|
|------|---------|---------|
|
|
| 2222 | `localhost:2200` | Forgejo SSH |
|
|
| 5432 | `pg.tail8d86e.ts.net:5432` | [[postgresql]] |
|
|
|
|
## Configuration
|
|
|
|
Caddy is managed via the `caddy` Ansible role:
|
|
|
|
```bash
|
|
# Deploy caddy changes
|
|
mise run provision-indri -- --tags caddy
|
|
```
|
|
|
|
**Key files:**
|
|
- `ansible/roles/caddy/defaults/main.yml` - Service definitions
|
|
- `ansible/roles/caddy/templates/Caddyfile.j2` - Caddy config template
|
|
|
|
## Secrets
|
|
|
|
| Secret | Source | Description |
|
|
|--------|--------|-------------|
|
|
| `GANDI_BEARER_TOKEN` | 1Password | API token for DNS-01 challenges |
|
|
|
|
The token is written to `~/.config/caddy/gandi-token` (chmod 0600) and sourced by the Caddy wrapper script.
|
|
|
|
## Security Considerations
|
|
|
|
Caddy has no authentication layer — it is a plain reverse proxy. Access control relies entirely on Tailscale ACLs restricting which devices can reach indri on port 443. Currently `tag:homelab` and `autogroup:admin` can reach Caddy. The [[flyio-proxy]] no longer routes through Caddy — it pushes logs and metrics directly to [[loki]] and [[prometheus]] via their Tailscale Ingress endpoints.
|
|
|
|
## Custom Build
|
|
|
|
Caddy is built from source with the Gandi DNS plugin:
|
|
|
|
```bash
|
|
# Build location
|
|
~/code/3rd/caddy/bin/caddy
|
|
```
|
|
|
|
The build includes the `github.com/caddy-dns/gandi` plugin for ACME DNS-01 challenges.
|
|
|
|
## Related
|
|
|
|
- [[gandi]] - DNS hosting and ACME DNS-01 provider
|
|
- [[routing]] - Service routing architecture
|
|
- [[forgejo]] - Git forge (proxied by Caddy)
|
|
- [[zot]] - Container registry (proxied by Caddy)
|
|
- [[tailscale-operator]] - K8s services use Tailscale Ingress, then Caddy
|