kongkxandClaude Opus 5
8e919c74d0
Cloudflare's free Universal SSL covers kucial.com and *.kucial.com only, so a hostname published through the tunnel cannot sit under dev.kucial.com's extra level — it fails TLS at the edge whatever the tunnel says. main is therefore reached at gig-api.kucial.com publicly and gig-platform.dev.kucial.com on the LAN (gig-web.kucial.com for gig-app), while the LAN-only instances keep their deeper names, which Caddy serves with its own DNS-01 certificates. sites/legacy-gig.caddy is removed: the old preview stack is retired, and its gig-api.kucial.com block would now collide with main's. `caddy validate` passes against the custom Cloudflare-DNS build. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01LpmavGWZa9nKFwpeLLW4D3
17 lines
615 B
Plaintext
17 lines
615 B
Plaintext
# gig-app web SPA instances (gig-app .gitea/workflows/deploy-web.yml). Copy to
|
|
# the infra Caddy's sites/ directory. Same shape as gig-platform.caddy: the
|
|
# apex is main, the wildcard routes pr-<N> by label.
|
|
|
|
# gig-web.kucial.com is main's public name (one label, so free Universal SSL
|
|
# covers it); the dev apex stays as a LAN alias.
|
|
gig-web.kucial.com, gig-app.dev.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy gig-app-main-web:80
|
|
}
|
|
|
|
*.gig-app.dev.kucial.com {
|
|
import cloudflare_tls
|
|
# No health checks: placeholder upstreams share health state.
|
|
reverse_proxy gig-app-{http.request.host.labels.4}-web:80
|
|
}
|