hetzner-infra/caddy/entrypoint.sh, branch master

Restrict proxy to Japan IPs using ipdeny.com CIDR list

2026-07-02T15:45:51+00:00

Downloads jp-aggregated.zone from ipdeny.com at container startup (no
account required). Falls back to open access if download fails.
Removed caddy-maxmind-geoip module (no longer needed).

Co-Authored-By: Claude Sonnet 4.6

Add GeoIP Japan-only filter to forward proxy

2026-07-02T15:40:17+00:00

Uses caddy-maxmind-geoip module to restrict proxy access to JP IPs.
DB file (GeoLite2-Country.mmdb) must be placed manually on the server.
Filter is inactive when DB file is absent, allowing safe rollout.

Co-Authored-By: Claude Sonnet 4.6

Fix HTTP proxy: use catch-all http:// block for port 80

2026-07-02T15:26:47+00:00

The forward_proxy site block must catch all hosts on port 80 because
proxy clients send Host:  not Host: proxy.yyamashita.com.
Non-proxy requests fall through to the redir for HTTPS upgrade.

Co-Authored-By: Claude Sonnet 4.6

Fix forward_proxy config: remove unsupported hide_ip/hide_via directives

2026-07-02T14:27:15+00:00

Co-Authored-By: Claude Sonnet 4.6

Temporarily disable proxy auth (PROXY_NO_AUTH=1)

2026-07-02T14:17:37+00:00

Add PROXY_NO_AUTH env var support to entrypoint.sh to skip basicauth
generation. Set to 1 in docker-compose.yml to allow unauthenticated access.
Revert by removing the environment block from docker-compose.yml.

Co-Authored-By: Claude Sonnet 4.6

Move forward proxy from Squid to Caddy (port 80/443)

2026-07-02T14:08:58+00:00

Replace standalone Squid container with caddy-forwardproxy plugin so the
proxy shares Caddy's existing ports and TLS. HTTP on :80 and HTTPS on :443.
Auth is read from the same vpn/users.conf at Caddy startup via entrypoint.sh.
DNS: add proxy to setup-route53.py WEB_SUBDOMAINS.

Co-Authored-By: Claude Sonnet 4.6