hetzner-infra/caddy/Caddyfile, branch master

Dedupe Caddyfile with snippets, sync docs with reality, add tests/check.sh

2026-07-11T11:35:09+00:00

- Caddyfile: extract repeated header blocks into (noindex)/(crawler_bypass)
  snippets (adapted JSON verified byte-identical to previous config)
- CLAUDE.md: add mosquitone-admin/microblog to repos table; document that
  proxy auth is disabled (PROXY_NO_AUTH=1) with JP-only IP filter instead
- Deploy.md/caddy/README.md: reflect all-service deploy and forward proxy
- tests/check.sh: shell/python syntax, repos.txt<->hooks<->sessions.txt
  consistency, app.py COMMANDS vs run-command.sh whitelist, secrets check

Co-Authored-By: Claude Opus 4.7

Restrict proxy to Japan IPs using ipdeny.com CIDR list

2026-07-02T15:45:51+00:00

Downloads jp-aggregated.zone from ipdeny.com at container startup (no
account required). Falls back to open access if download fails.
Removed caddy-maxmind-geoip module (no longer needed).

Co-Authored-By: Claude Sonnet 4.6

Add GeoIP Japan-only filter to forward proxy

2026-07-02T15:40:17+00:00

Uses caddy-maxmind-geoip module to restrict proxy access to JP IPs.
DB file (GeoLite2-Country.mmdb) must be placed manually on the server.
Filter is inactive when DB file is absent, allowing safe rollout.

Co-Authored-By: Claude Sonnet 4.6

Fix HTTP proxy directive order: forward_proxy must run before redir

2026-07-02T15:32:18+00:00

Caddy's default directive ordering places redir before forward_proxy,
causing HTTP proxy requests to be redirected to HTTPS instead of being
forwarded. Changing order to forward_proxy before redir fixes this.

Co-Authored-By: Claude Sonnet 4.6

Add global order option for forward_proxy directive

2026-07-02T14:28:40+00:00

Co-Authored-By: Claude Sonnet 4.6

Move forward proxy from Squid to Caddy (port 80/443)

2026-07-02T14:08:58+00:00

Replace standalone Squid container with caddy-forwardproxy plugin so the
proxy shares Caddy's existing ports and TLS. HTTP on :80 and HTTPS on :443.
Auth is read from the same vpn/users.conf at Caddy startup via entrypoint.sh.
DNS: add proxy to setup-route53.py WEB_SUBDOMAINS.

Co-Authored-By: Claude Sonnet 4.6

Add HTTPS forward proxy service (Squid on port 8443)

2026-07-02T13:58:56+00:00

- proxy/: Squid container with HTTPS port, Basic auth from vpn/users.conf
- caddy/Caddyfile: add proxy.yyamashita.com block (RSA cert for compat)
- git/hooks: add proxy/deploy.sh to post-receive hook
- CLAUDE.md: document proxy setup and client config

Co-Authored-By: Claude Sonnet 4.6

Force RSA4096 cert for VPN domain to fix iOS IKEv2

2026-07-02T01:23:08+00:00

ECDSA chain (YE1→Root YE→ISRG Root X2) is not trusted by iOS IKEv2.
RSA chain (Leaf→R10→ISRG Root X1) is universally trusted.

Co-Authored-By: Claude Sonnet 4.6

Serve YE1 intermediate CA cert for Android VPN trust chain

2026-07-01T01:48:36+00:00

Android (XREAL Beam Pro) can't validate the server cert because it lacks
the Let's Encrypt YE1 hierarchy in its system trust store. The fix:
- Serve YE1 cert at https://vpn.yyamashita.com/ca.pem via Caddy
- Android VPN profile: set CA certificate to this downloaded cert
- install.sh / renew-cert.sh now extract and copy YE1 to caddy dir

Co-Authored-By: Claude Sonnet 4.6

Add strongSwan IKEv2 VPN service

2026-06-30T13:29:07+00:00

- vpn/: Dockerfile, docker-compose.yml, swanctl.conf.tpl, entrypoint.sh
- install.sh: Caddy 証明書流用 + コンテナ起動
- renew-cert.sh: 証明書更新 + swanctl ホットリロード
- caddy/Caddyfile: vpn.yyamashita.com 追加（Let's Encrypt 証明書取得用）
- post-receive: vpn/deploy.sh を追加
- setup-route53.py: WEB_SUBDOMAINS に vpn を追加

Co-Authored-By: Claude Sonnet 4.6