From 579daf4aa1875a739c084ea7051e6b4d203f0c69 Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Fri, 3 Jul 2026 00:26:47 +0900
Subject: Fix HTTP proxy: use catch-all http:// block for port 80

The forward_proxy site block must catch all hosts on port 80 because
proxy clients send Host: <target> not Host: proxy.yyamashita.com.
Non-proxy requests fall through to the redir for HTTPS upgrade.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 caddy/entrypoint.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh
index f9b9c19..ecf2e90 100644
--- a/caddy/entrypoint.sh
+++ b/caddy/entrypoint.sh
@@ -15,9 +15,10 @@ fi
 AUTH_BLOCK=$(printf '%b' "$AUTH_LINES")
 
 cat > "$PROXY_CONF" <<EOF
-http://proxy.yyamashita.com {
+http:// {
     forward_proxy {
 ${AUTH_BLOCK}    }
+    redir https://{host}{uri} 308
 }
 https://proxy.yyamashita.com {
     tls {
-- 
cgit v1.2.3