From 1a7b5adf8484ec0f2b6feb350b578142e186ab26 Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Thu, 2 Jul 2026 23:08:58 +0900
Subject: Move forward proxy from Squid to Caddy (port 80/443)

Replace standalone Squid container with caddy-forwardproxy plugin so the
proxy shares Caddy's existing ports and TLS. HTTP on :80 and HTTPS on :443.
Auth is read from the same vpn/users.conf at Caddy startup via entrypoint.sh.
DNS: add proxy to setup-route53.py WEB_SUBDOMAINS.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 caddy/entrypoint.sh | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 caddy/entrypoint.sh

(limited to 'caddy/entrypoint.sh')

diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh
new file mode 100644
index 0000000..cf123ce
--- /dev/null
+++ b/caddy/entrypoint.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+set -e
+
+PROXY_CONF=/tmp/proxy_forward.caddy
+
+# Build basicauth lines from shared users.conf
+AUTH_LINES=""
+if [ -f /etc/proxy/users.conf ]; then
+    while IFS=' ' read -r user pass || [ -n "$user" ]; do
+        [ -z "$user" ] && continue
+        case "$user" in \#*) continue ;; esac
+        AUTH_LINES="${AUTH_LINES}        basicauth ${user} ${pass}\n"
+    done < /etc/proxy/users.conf
+fi
+AUTH_BLOCK=$(printf '%b' "$AUTH_LINES")
+
+cat > "$PROXY_CONF" <<EOF
+http://proxy.yyamashita.com {
+    forward_proxy {
+${AUTH_BLOCK}        hide_ip
+        hide_via
+    }
+}
+https://proxy.yyamashita.com {
+    tls {
+        key_type rsa4096
+    }
+    forward_proxy {
+${AUTH_BLOCK}        hide_ip
+        hide_via
+    }
+}
+EOF
+
+exec "$@"
-- 
cgit v1.2.3