olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bootstrap): caddy public ingress + DNS-01 TLS (T07)

Browse source 
foundation-caddy — the only public ingress (80/443 published), automatic TLS via
Let's Encrypt DNS-01 over Cloudflare. Standard caddy:2 lacks the DNS plugin, so
the egg builds a custom image on the VM (containers/caddy-cloudflare/Dockerfile:
xcaddy + caddy-dns/cloudflare@v0.2.4, base digests pinned) via a remote.Command
(ADR-007) whose stdout image id the container runs. The Caddyfile carries no
secrets — the CF token is read from the container env ({env.CF_API_TOKEN}) — and
is rendered + bind-mounted from the host. Routes forge -> Forgejo:3000 and
s3 -> RustFS:9000; Vault is intentionally not proxied publicly (CONTRACT_003
"restricted").

Live on cx33 Helsinki: certs obtained for forge + s3; https://forge.olsitec.net
= 502 (Forgejo lands in T08) and https://s3.olsitec.net = 403 (RustFS), both over
valid Let's Encrypt certs (DNS-01). Acceptance T07 met.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andreas Niemann 2026-06-30 21:54:12 +02:00
parent fa242e4e76
commit 6a7c28b54c
4 changed files with 168 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
containers/caddy-cloudflare/Dockerfile Normal file
View file

@ -0,0 +1,15 @@
# Custom Caddy image with the Cloudflare DNS-01 plugin (standard caddy:2 lacks it,
# and DNS-01 is how the egg gets TLS before/without HTTP reachability — PLAN-002
# §9.4). Built on the VM by components/proxy.ts (ADR-007); the resulting image id
# is what the foundation-caddy container runs.
#
# Determinism (D5): base images pinned by digest, DNS module pinned by version.
# Bump = edit this file → proxy.ts's build command rebuilds (Dockerfile is a trigger).
# builder caddy:2.10-builder sha256:01668408cc26e2e00c9d067c30cb43b2ba14ad1f2808beda55503cb2a31f59dc
# final caddy:2.10 sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
# module github.com/caddy-dns/cloudflare v0.2.4 (libdns/cloudflare v0.2.2)
FROM caddy@sha256:01668408cc26e2e00c9d067c30cb43b2ba14ad1f2808beda55503cb2a31f59dc AS builder
RUN xcaddy build --with github.com/caddy-dns/cloudflare@v0.2.4
FROM caddy@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
COPY --from=builder /usr/bin/caddy /usr/bin/caddy