31 lines
1.1 KiB
Plaintext
31 lines
1.1 KiB
Plaintext
# The console, served on the WireGuard hub address.
|
|
#
|
|
# Runs inside the provisioning container's network namespace, so it listens on
|
|
# 10.66.0.1 — the tunnel address itself. A VPN client therefore needs no route
|
|
# beyond the management subnet it already has, and the request arrives at the
|
|
# application with its real 10.66.0.x source, which is what the console's own
|
|
# IP allowlist checks.
|
|
#
|
|
# The certificate is the one the public Caddy already obtains and renews for
|
|
# this hostname. A certificate is bound to the NAME, not to the address that
|
|
# serves it, so the same file is valid here. Shared read-only rather than
|
|
# duplicated: a second ACME client would be a second thing to renew, and a
|
|
# private address cannot satisfy an HTTP challenge in any case.
|
|
{
|
|
admin off
|
|
auto_https off
|
|
}
|
|
|
|
https://{$VPN_INTERNAL_HOST}:443 {
|
|
bind {$VPN_HUB_ADDRESS}
|
|
tls {$VPN_CERT_PATH} {$VPN_KEY_PATH}
|
|
|
|
# To the application directly. Resolvable because this container shares the
|
|
# provisioning container's namespace, which is on the compose network.
|
|
reverse_proxy app:80 {
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto https
|
|
header_up Host {host}
|
|
}
|
|
}
|