From 6933ec28be3dac0dc17cd634c663db3b4818caad Mon Sep 17 00:00:00 2001
From: Doan Luu Duc Tai <doan@luuduct.ai>
Date: Fri, 30 Oct 2026 22:36:11 -0500
Subject: Centralize deployment settings in the root environment file

Document public domains, ports, upstreams, chat binding, and backup defaults alongside private settings. Validate shared configuration and render Caddy, cgit, and website links from an explicit public allowlist while preserving one installation environment file.
---
 infra/Caddyfile | 45 +++++++++++++++++++++++++--------------------
 1 file changed, 25 insertions(+), 20 deletions(-)

(limited to 'infra/Caddyfile')

diff --git a/infra/Caddyfile b/infra/Caddyfile
index 3146529..424e129 100644
--- a/infra/Caddyfile
+++ b/infra/Caddyfile
@@ -13,11 +13,16 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
+{
+    http_port {{HTTP_PORT}}
+    https_port {{HTTPS_PORT}}
+}
+
 (https_security) {
     header >Strict-Transport-Security "max-age=31536000"
 }
 
-luuduct.ai {
+https://{{BASE_DOMAIN}}:{{HTTPS_PORT}} {
 	import https_security
 	handle /.well-known/openpgpkey/* {
 		root * /srv
@@ -26,16 +31,16 @@ luuduct.ai {
 	}
 
 	handle {
-		redir https://doan.luuduct.ai{uri} permanent
+		redir {{SITE_ORIGIN}}{uri} permanent
 	}
 }
 
-www.luuduct.ai {
+https://www.{{BASE_DOMAIN}}:{{HTTPS_PORT}} {
 	import https_security
-	redir https://doan.luuduct.ai{uri} permanent
+	redir {{SITE_ORIGIN}}{uri} permanent
 }
 
-doan.luuduct.ai {
+https://{{SITE_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	root * /srv
 	file_server
@@ -43,15 +48,15 @@ doan.luuduct.ai {
 	redir /git /git/
 
 	handle /cgit* {
-		reverse_proxy cgit:8080
+		reverse_proxy {{CGIT_UPSTREAM}}
 	}
 
 	handle /git/* {
-		reverse_proxy cgit:8080
+		reverse_proxy {{CGIT_UPSTREAM}}
 	}
 }
 
-openpgpkey.luuduct.ai {
+https://{{WKD_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	handle /.well-known/openpgpkey/* {
 		root * /srv
@@ -60,34 +65,34 @@ openpgpkey.luuduct.ai {
 	}
 }
 
-git.doan.luuduct.ai {
+https://{{GIT_HOST}}:{{HTTPS_PORT}} {
 	import https_security
 	redir /{path}.git /{path} permanent
 
-	reverse_proxy cgit:8080
+	reverse_proxy {{CGIT_UPSTREAM}}
 }
 
-search.doan.luuduct.ai {
+https://{{SEARCH_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-	reverse_proxy searxng:8080
+	reverse_proxy {{SEARXNG_UPSTREAM}}
 }
 
-www.doan.luuduct.ai {
+https://www.{{SITE_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://doan.luuduct.ai{uri} permanent
+    redir {{SITE_ORIGIN}}{uri} permanent
 }
 
-www.git.doan.luuduct.ai {
+https://www.{{GIT_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://git.doan.luuduct.ai{uri} permanent
+    redir {{GIT_ORIGIN}}{uri} permanent
 }
 
-www.search.doan.luuduct.ai {
+https://www.{{SEARCH_HOST}}:{{HTTPS_PORT}} {
 	import https_security
-    redir https://search.doan.luuduct.ai{uri} permanent
+    redir {{SEARCH_ORIGIN}}{uri} permanent
 }
 
-www.openpgpkey.luuduct.ai {
+https://www.{{WKD_HOST}}:{{HTTPS_PORT}} {
     import https_security
-    redir https://openpgpkey.luuduct.ai{uri} permanent
+    redir {{WKD_ORIGIN}}{uri} permanent
 }
-- 
cgit v1.2.3