Centralize deployment settings in the root environment file

Document public domains, ports, upstreams, chat binding, and backup defaults alongside private settings. Validate shared configuration and render Caddy, cgit, and website links from an explicit public allowlist while preserving one installation environment file.

1 files changed, 25 insertions, 20 deletions

diff --git a/infra/Caddyfile b/infra/Caddyfile
index 3146529..424e129 100644
--- a/infra/Caddyfile
+++ b/infra/Caddyfile
@@ -13,11 +13,16 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
+{
+    http_port {{HTTP_PORT}}
+    https_port {{HTTPS_PORT}}
+}
+
 (https_security) {
     header >Strict-Transport-Security "max-age=31536000"
 }
 
-luuduct.ai {
+https://{{BASE_DOMAIN}}:{{HTTPS_PORT}} {
 	import https_security
 	handle /.well-known/openpgpkey/* {
 		root * /srv
@@ -26,16 +31,16 @@ luuduct.ai {
 	}
 
 	handle {
-		redir https://doan.luuduct.ai{uri} permanent
+		redir {{SITE_ORIGIN}}{uri} permanent
 	}
 }
 
-www.luuduct.ai {
+https://www.{{BASE_DOMAIN}}:{{HTTPS_PORT}} {
 	import https_security
-	redir https://doan.luuduct.ai{uri} permanent
+	redir {{SITE_ORIGIN}}{uri} permanent
 }
 
-doan.luuduct.ai {
+https://{{SITE_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	root * /srv
 	file_server
@@ -43,15 +48,15 @@ doan.luuduct.ai {
 	redir /git /git/
 
 	handle /cgit* {
-		reverse_proxy cgit:8080
+		reverse_proxy {{CGIT_UPSTREAM}}
 	}
 
 	handle /git/* {
-		reverse_proxy cgit:8080
+		reverse_proxy {{CGIT_UPSTREAM}}
 	}
 }
 
-openpgpkey.luuduct.ai {
+https://{{WKD_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	handle /.well-known/openpgpkey/* {
 		root * /srv
@@ -60,34 +65,34 @@ openpgpkey.luuduct.ai {
 	}
 }
 
-git.doan.luuduct.ai {
+https://{{GIT_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	redir /{path}.git /{path} permanent
 
-	reverse_proxy cgit:8080
+	reverse_proxy {{CGIT_UPSTREAM}}
 }
 
-search.doan.luuduct.ai {
+https://{{SEARCH_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-	reverse_proxy searxng:8080
+	reverse_proxy {{SEARXNG_UPSTREAM}}
 }
 
-www.doan.luuduct.ai {
+https://www.{{SITE_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://doan.luuduct.ai{uri} permanent
+    redir {{SITE_ORIGIN}}{uri} permanent
 }
 
-www.git.doan.luuduct.ai {
+https://www.{{GIT_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://git.doan.luuduct.ai{uri} permanent
+    redir {{GIT_ORIGIN}}{uri} permanent
 }
 
-www.search.doan.luuduct.ai {
+https://www.{{SEARCH_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://search.doan.luuduct.ai{uri} permanent
+    redir {{SEARCH_ORIGIN}}{uri} permanent
 }
 
-www.openpgpkey.luuduct.ai {
+https://www.{{WKD_HOST}}:{{HTTPS_PORT}} {
     import https_security
-    redir https://openpgpkey.luuduct.ai{uri} permanent
+    redir {{WKD_ORIGIN}}{uri} permanent
 }