diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 23:08:58 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 23:08:58 +0900 |
| commit | 1a7b5adf8484ec0f2b6feb350b578142e186ab26 (patch) | |
| tree | e8c670ac5554d2b17b491ee96e9717f4432d64a9 /caddy | |
| parent | 88be3b3f503d4674d764a7265edb2d4e380ae738 (diff) | |
Move forward proxy from Squid to Caddy (port 80/443)
Replace standalone Squid container with caddy-forwardproxy plugin so the
proxy shares Caddy's existing ports and TLS. HTTP on :80 and HTTPS on :443.
Auth is read from the same vpn/users.conf at Caddy startup via entrypoint.sh.
DNS: add proxy to setup-route53.py WEB_SUBDOMAINS.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'caddy')
| -rw-r--r-- | caddy/Caddyfile | 7 | ||||
| -rw-r--r-- | caddy/Dockerfile | 9 | ||||
| -rw-r--r-- | caddy/docker-compose.yml | 3 | ||||
| -rw-r--r-- | caddy/entrypoint.sh | 35 |
4 files changed, 47 insertions, 7 deletions
diff --git a/caddy/Caddyfile b/caddy/Caddyfile index 5ab87a7..3cf3547 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -41,12 +41,7 @@ blog.yyamashita.com { reverse_proxy microblog-app:3000 } -proxy.yyamashita.com { - tls { - key_type rsa4096 - } - respond "Proxy Server" 200 -} +import /tmp/proxy_forward.caddy vpn.yyamashita.com { tls { diff --git a/caddy/Dockerfile b/caddy/Dockerfile new file mode 100644 index 0000000..295437b --- /dev/null +++ b/caddy/Dockerfile @@ -0,0 +1,9 @@ +FROM caddy:2-builder-alpine AS builder +RUN xcaddy build --with github.com/caddyserver/forwardproxy@caddy2 + +FROM caddy:2-alpine +COPY --from=builder /usr/bin/caddy /usr/bin/caddy +COPY entrypoint.sh /entrypoint.sh +RUN chmod +x /entrypoint.sh +ENTRYPOINT ["/entrypoint.sh"] +CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"] diff --git a/caddy/docker-compose.yml b/caddy/docker-compose.yml index 3e9385d..e23d25a 100644 --- a/caddy/docker-compose.yml +++ b/caddy/docker-compose.yml @@ -1,6 +1,6 @@ services: caddy: - image: caddy:2-alpine + build: . ports: - "80:80" - "443:443" @@ -9,6 +9,7 @@ services: - ./:/etc/caddy/ - caddy_data:/data - caddy_config:/config + - /app/infra/vpn/users.conf:/etc/proxy/users.conf:ro restart: unless-stopped networks: - web diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh new file mode 100644 index 0000000..cf123ce --- /dev/null +++ b/caddy/entrypoint.sh @@ -0,0 +1,35 @@ +#!/bin/sh +set -e + +PROXY_CONF=/tmp/proxy_forward.caddy + +# Build basicauth lines from shared users.conf +AUTH_LINES="" +if [ -f /etc/proxy/users.conf ]; then + while IFS=' ' read -r user pass || [ -n "$user" ]; do + [ -z "$user" ] && continue + case "$user" in \#*) continue ;; esac + AUTH_LINES="${AUTH_LINES} basicauth ${user} ${pass}\n" + done < /etc/proxy/users.conf +fi +AUTH_BLOCK=$(printf '%b' "$AUTH_LINES") + +cat > "$PROXY_CONF" <<EOF +http://proxy.yyamashita.com { + forward_proxy { +${AUTH_BLOCK} hide_ip + hide_via + } +} +https://proxy.yyamashita.com { + tls { + key_type rsa4096 + } + forward_proxy { +${AUTH_BLOCK} hide_ip + hide_via + } +} +EOF + +exec "$@" |