hetzner-infra/caddy, branch master

Dedupe Caddyfile with snippets, sync docs with reality, add tests/check.sh

2026-07-11T11:35:09+00:00

- Caddyfile: extract repeated header blocks into (noindex)/(crawler_bypass)
  snippets (adapted JSON verified byte-identical to previous config)
- CLAUDE.md: add mosquitone-admin/microblog to repos table; document that
  proxy auth is disabled (PROXY_NO_AUTH=1) with JP-only IP filter instead
- Deploy.md/caddy/README.md: reflect all-service deploy and forward proxy
- tests/check.sh: shell/python syntax, repos.txt<->hooks<->sessions.txt
  consistency, app.py COMMANDS vs run-command.sh whitelist, secrets check

Co-Authored-By: Claude Opus 4.7

Restrict proxy to Japan IPs using ipdeny.com CIDR list

2026-07-02T15:45:51+00:00

Downloads jp-aggregated.zone from ipdeny.com at container startup (no
account required). Falls back to open access if download fails.
Removed caddy-maxmind-geoip module (no longer needed).

Co-Authored-By: Claude Sonnet 4.6

Add GeoIP Japan-only filter to forward proxy

2026-07-02T15:40:17+00:00

Uses caddy-maxmind-geoip module to restrict proxy access to JP IPs.
DB file (GeoLite2-Country.mmdb) must be placed manually on the server.
Filter is inactive when DB file is absent, allowing safe rollout.

Co-Authored-By: Claude Sonnet 4.6

Fix HTTP proxy directive order: forward_proxy must run before redir

2026-07-02T15:32:18+00:00

Caddy's default directive ordering places redir before forward_proxy,
causing HTTP proxy requests to be redirected to HTTPS instead of being
forwarded. Changing order to forward_proxy before redir fixes this.

Co-Authored-By: Claude Sonnet 4.6

caddy: add --build to deploy.sh so entrypoint changes are picked up

2026-07-02T15:28:48+00:00

Co-Authored-By: Claude Sonnet 4.6

Fix HTTP proxy: use catch-all http:// block for port 80

2026-07-02T15:26:47+00:00

The forward_proxy site block must catch all hosts on port 80 because
proxy clients send Host:  not Host: proxy.yyamashita.com.
Non-proxy requests fall through to the redir for HTTPS upgrade.

Co-Authored-By: Claude Sonnet 4.6

Disable proxy auth permanently (PROXY_NO_AUTH=1)

2026-07-02T15:06:25+00:00

Co-Authored-By: Claude Sonnet 4.6

Re-enable proxy auth (remove PROXY_NO_AUTH=1)

2026-07-02T15:02:38+00:00

Co-Authored-By: Claude Sonnet 4.6

Add global order option for forward_proxy directive

2026-07-02T14:28:40+00:00

Co-Authored-By: Claude Sonnet 4.6

Fix forward_proxy config: remove unsupported hide_ip/hide_via directives

2026-07-02T14:27:15+00:00

Co-Authored-By: Claude Sonnet 4.6