Centralize deployment settings in the root environment file

Document public domains, ports, upstreams, chat binding, and backup defaults alongside private settings. Validate shared configuration and render Caddy, cgit, and website links from an explicit public allowlist while preserving one installation environment file.

4 files changed, 28 insertions, 52 deletions

diff --git a/infra/Caddyfile b/infra/Caddyfile
index 3146529..424e129 100644
--- a/infra/Caddyfile
+++ b/infra/Caddyfile
@@ -13,11 +13,16 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
+{
+    http_port {{HTTP_PORT}}
+    https_port {{HTTPS_PORT}}
+}
+
 (https_security) {
     header >Strict-Transport-Security "max-age=31536000"
 }
 
-luuduct.ai {
+https://{{BASE_DOMAIN}}:{{HTTPS_PORT}} {
 	import https_security
 	handle /.well-known/openpgpkey/* {
 		root * /srv
@@ -26,16 +31,16 @@ luuduct.ai {
 	}
 
 	handle {
-		redir https://doan.luuduct.ai{uri} permanent
+		redir {{SITE_ORIGIN}}{uri} permanent
 	}
 }
 
-www.luuduct.ai {
+https://www.{{BASE_DOMAIN}}:{{HTTPS_PORT}} {
 	import https_security
-	redir https://doan.luuduct.ai{uri} permanent
+	redir {{SITE_ORIGIN}}{uri} permanent
 }
 
-doan.luuduct.ai {
+https://{{SITE_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	root * /srv
 	file_server
@@ -43,15 +48,15 @@ doan.luuduct.ai {
 	redir /git /git/
 
 	handle /cgit* {
-		reverse_proxy cgit:8080
+		reverse_proxy {{CGIT_UPSTREAM}}
 	}
 
 	handle /git/* {
-		reverse_proxy cgit:8080
+		reverse_proxy {{CGIT_UPSTREAM}}
 	}
 }
 
-openpgpkey.luuduct.ai {
+https://{{WKD_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	handle /.well-known/openpgpkey/* {
 		root * /srv
@@ -60,34 +65,34 @@ openpgpkey.luuduct.ai {
 	}
 }
 
-git.doan.luuduct.ai {
+https://{{GIT_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	redir /{path}.git /{path} permanent
 
-	reverse_proxy cgit:8080
+	reverse_proxy {{CGIT_UPSTREAM}}
 }
 
-search.doan.luuduct.ai {
+https://{{SEARCH_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-	reverse_proxy searxng:8080
+	reverse_proxy {{SEARXNG_UPSTREAM}}
 }
 
-www.doan.luuduct.ai {
+https://www.{{SITE_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://doan.luuduct.ai{uri} permanent
+    redir {{SITE_ORIGIN}}{uri} permanent
 }
 
-www.git.doan.luuduct.ai {
+https://www.{{GIT_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://git.doan.luuduct.ai{uri} permanent
+    redir {{GIT_ORIGIN}}{uri} permanent
 }
 
-www.search.doan.luuduct.ai {
+https://www.{{SEARCH_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://search.doan.luuduct.ai{uri} permanent
+    redir {{SEARCH_ORIGIN}}{uri} permanent
 }
 
-www.openpgpkey.luuduct.ai {
+https://www.{{WKD_HOST}}:{{HTTPS_PORT}} {
     import https_security
-    redir https://openpgpkey.luuduct.ai{uri} permanent
+    redir {{WKD_ORIGIN}}{uri} permanent
 }
diff --git a/infra/Caddyfile.local b/infra/Caddyfile.local
index 4d3bf11..6e3508c 100644
--- a/infra/Caddyfile.local
+++ b/infra/Caddyfile.local
@@ -19,12 +19,12 @@
     @git path /git /git/* /cgit.js /cgit.png
     handle @git {
         uri strip_prefix /git
-        reverse_proxy cgit:8080
+        reverse_proxy {{CGIT_UPSTREAM}}
     }
 
     @search path /search /search/*
     handle @search {
-        reverse_proxy searxng:8080 {
+        reverse_proxy {{SEARXNG_UPSTREAM}} {
             header_up X-Script-Name /search
         }
     }
diff --git a/infra/containers/cgit/cgitrc b/infra/containers/cgit/cgitrc
index 9aaf8d5..0dacb99 100644
--- a/infra/containers/cgit/cgitrc
+++ b/infra/containers/cgit/cgitrc
@@ -16,7 +16,7 @@
 root-title=Doan Luu Duc Tai's repositories
 root-desc=Personal git repos
 virtual-root=/
-clone-prefix=https://git.doan.luuduct.ai
+clone-prefix={{GIT_ORIGIN}}
 css=/cgit.css
 favicon=/favicon.ico
 remove-suffix=1
diff --git a/infra/containers/cgit/cgitrc.local b/infra/containers/cgit/cgitrc.local
deleted file mode 100644
index 20b533a..0000000
--- a/infra/containers/cgit/cgitrc.local
+++ /dev/null
@@ -1,29 +0,0 @@
-# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-root-title=Doan Luu Duc Tai's repositories (local)
-root-desc=Restored local copy
-virtual-root=/git/
-clone-prefix=http://localhost:8080/git
-css=/git/cgit.css
-favicon=/git/favicon.ico
-remove-suffix=1
-defbranch=main
-cache-root=/var/cache/cgit
-cache-size=1000
-cache-scanrc-ttl=1
-readme=:web/THIRD-PARTY-LICENSES.html
-about-filter=lua:/etc/cgit-license.lua
-scan-path=/srv/git