Repository navigation
dev2-edge: pit.world and the Moshpit names on Caddy, every other site on nginx - #199
Merged
Merged
Conversation
… on nginx nginx's stream module takes :443 and routes by TLS server name (ssl_preread): pit.world, *.pit.world and the Moshpit names in dev2/edge/edge.json go to Caddy on 127.0.0.1:8453, everything else to nginx's https servers on 127.0.0.1:8444, both with a PROXY protocol header so client addresses survive. - dev2/dev2-edge: render / apply / route on|off / rollback / sweep / status - dev2/edge/edge-box: the box side; apply backs up /etc/nginx, sweeps every name twice, checks Caddy answers like nginx on its own port before any traffic moves, switches with one nginx reload, sweeps again and rolls back on any change - caddy-edge-certs (+ .path/.timer): Caddy loads bundles of the certificates certbot, pit-proxy-cert and moshpit-renew already renew; Caddy issues nothing - nginx-edge-listen (+ nginx.service drop-in, .path): rewrites any `listen 443` a tool writes later (install.sh, setup-origin.sh, certbot --nginx), which would otherwise pass nginx -t and then silently fail to bind on reload - dev2-site vhost renders the 8444 form when the edge is on - test/dev2-edge.test.ts Rehearsed on dev3 against a copy of dev2's nginx config: 287 names same status before/after, SNI routing, client IP in nginx and Caddy upstreams, websockets, http->https, no dropped requests across the switch and the rollback, renewal pickup, stray listen 443 repair, rollback restores /etc/nginx byte for byte. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ThreatCrush Security Scan41 finding(s) HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14
Snippets are redacted; ThreatCrush never prints matched credential material. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…; route waits for the reload Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Anthony approved 2026-10-19 ("pit.world first"): nginx hands only pit.world traffic, by TLS name, to Caddy; every other site stays on nginx.
What
stream {}on :443 (v4+v6),ssl_preread,map $ssl_preread_server_name(hostnames):pit.world,www.pit.world,*.pit.world, and the Moshpit names indev2/edge/edge.json-> Caddy127.0.0.1:8453; default -> nginx127.0.0.1:8444.proxy_protocol onto both.listen 443 sslbecomeslisten 127.0.0.1:8444 ssl proxy_protocolwithset_real_ip_from 127.0.0.1; real_ip_header proxy_protocol; port_in_redirect off;(http level), so$remote_addr, rate limits, logs and ThreatCrush keep the visitor's address.caddy, usercaddy,auto_https off,proxy_protocollistener wrapper, h1/h2 only, same upstreams/body limits as the nginx blocks, TLS 1.3-only for Moshpit names as before.live.streaming.pit.worldstays on nginx for now (keep_on_nginx).caddy-edge-certsbundles what certbot (pit.world),pit-proxy-cert(<name>.pit.world) andmoshpit-renew(Moshpit names) already keep current; a.pathunit reloads Caddy within a second of a renewal. Port 80 stays on nginx (ACME + http->https).listen 443guard. With the stream on :443, a vhost withlisten 443passesnginx -tbut the reload cannot bind and nginx silently keeps the old config (a restart fails outright). OpenInstallbin/install.sh,setup-origin.sh(every Moshpit renewal) andcertbot --nginxstill write it, songinx-edge-listenrewrites it before every nginx start/reload (systemd drop-in) and on any vhost change (.path).dev2-site vhostrenders the 8444 form when the edge is on.dev2-edge apply --yesdoes the cutover with a backup, a two-pass baseline sweep of every name, a Caddy-only check on its own port before traffic moves, one nginx reload, an after sweep, and automatic rollback on any status change.dev2-edge route offis the one-reload way back;dev2-edge rollbackrestores/etc/nginxfrom the tarball.Rehearsal (dev3, Docker, dev2's real nginx config with self-signed certs at every path)
Serverheader), client IP 172.17.0.1 seen by Caddy upstreams (X-Real-IP/XFF) and in nginx$remote_addr, websockets through Caddy (bbs.chovy.hacker.pit.world, pit.world, family.ancestry), http->https unchanged, TLS 1.3-only + X25519MLKEM768 on Moshpit names, no:8444in nginx redirects.nginx -tfailure both rolled back; the restored/etc/nginxwas byte-identical to the backup.listen 443repaired, path-unit semantics checked with systemd on dev3.Tests
test/dev2-edge.test.ts(11): the listen rewrite (variants, symlinks, idempotence, reverse), render (routing, Caddy sites per edge.json,--off, realip,caddy adaptwhen available), cert bundling (mismatch skipped, reload only on change).🤖 Generated with Claude Code