From a3c730e1dbf5785d0074d966d9bb6b7ea7103b89 Mon Sep 17 00:00:00 2001 From: agent Date: Sun, 27 Sep 2026 15:32:49 +0000 Subject: [PATCH] Move all services from srazka.com to reudy.net Renames every domain in the config: Caddy virtual hosts (auth, hello, nextcloud, git, panel), the ACME contact email, Authelia's session cookie domain / portal URL / default redirect and TOTP issuer, Nextcloud's hostName and overwritehost, and Forgejo's DOMAIN (ROOT_URL and ssh clone URLs follow from it; the panel picks them up via panel.nix). Panel docs and examples updated too, and a README paragraph that had run together is split again. Requires DNS for auth/hello/nextcloud/git/panel.reudy.net (or a *.reudy.net wildcard) pointing at the server before deploying. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf --- authelia.nix | 10 +++++----- caddy.nix | 10 +++++----- forgejo.nix | 4 ++-- nextcloud.nix | 4 ++-- panel.nix | 2 +- panel/API.md | 26 +++++++++++++------------- panel/README.md | 16 +++++++++------- panel/panelctl.sh | 2 +- 8 files changed, 38 insertions(+), 36 deletions(-) diff --git a/authelia.nix b/authelia.nix index 4483283..ea61a69 100644 --- a/authelia.nix +++ b/authelia.nix @@ -45,7 +45,7 @@ totp = { disable = false; - issuer = "srazka.com"; + issuer = "reudy.net"; period = 30; }; @@ -70,9 +70,9 @@ cookies = [ { - domain = "srazka.com"; - authelia_url = "https://auth.srazka.com"; - default_redirection_url = "https://hello.srazka.com"; + domain = "reudy.net"; + authelia_url = "https://auth.reudy.net"; + default_redirection_url = "https://hello.reudy.net"; } ]; }; @@ -82,7 +82,7 @@ default_policy = "two_factor"; # You can add per-domain rules here later, e.g.: # rules = [ - # { domain = "hello.srazka.com"; policy = "two_factor"; } + # { domain = "hello.reudy.net"; policy = "two_factor"; } # ]; }; diff --git a/caddy.nix b/caddy.nix index dc45810..24486f2 100755 --- a/caddy.nix +++ b/caddy.nix @@ -2,7 +2,7 @@ { services.caddy = { enable = true; - email = "admin@srazka.com"; + email = "admin@reudy.net"; # Generated app routes from the panel backend. extraConfig = '' @@ -10,12 +10,12 @@ ''; # Authelia's own login portal - virtualHosts."auth.srazka.com".extraConfig = '' + virtualHosts."auth.reudy.net".extraConfig = '' reverse_proxy 127.0.0.1:9091 ''; # Every protected site uses this snippet - virtualHosts."hello.srazka.com".extraConfig = '' + virtualHosts."hello.reudy.net".extraConfig = '' forward_auth 127.0.0.1:9091 { uri /api/authz/forward-auth copy_headers Remote-User Remote-Groups Remote-Email Remote-Name @@ -26,7 +26,7 @@ # Nextcloud — served by local nginx # (Authelia forward-auth disabled for now; re-enable by uncommenting the # forward_auth block below.) - virtualHosts."nextcloud.srazka.com".extraConfig = '' + virtualHosts."nextcloud.reudy.net".extraConfig = '' # forward_auth 127.0.0.1:9091 { # uri /api/authz/forward-auth # copy_headers Remote-User Remote-Groups Remote-Email Remote-Name @@ -36,7 +36,7 @@ # Forgejo — no Authelia forward-auth, since it would break git over HTTPS # and the API. Forgejo handles its own logins. - virtualHosts."git.srazka.com".extraConfig = '' + virtualHosts."git.reudy.net".extraConfig = '' reverse_proxy 127.0.0.1:14921 ''; }; diff --git a/forgejo.nix b/forgejo.nix index 47846df..0a73611 100644 --- a/forgejo.nix +++ b/forgejo.nix @@ -1,6 +1,6 @@ { config, ... }: let - domain = "git.srazka.com"; + domain = "git.reudy.net"; sshPort = 14922; in { @@ -24,7 +24,7 @@ in # Forgejo's built-in SSH server, separate from the system sshd (which # only allows 'reudy' on 14902). Clone URLs look like: - # ssh://git@git.srazka.com:14922//.git + # ssh://git@git.reudy.net:14922//.git START_SSH_SERVER = true; SSH_PORT = sshPort; SSH_LISTEN_PORT = sshPort; diff --git a/nextcloud.nix b/nextcloud.nix index 87a0c1a..41d8531 100644 --- a/nextcloud.nix +++ b/nextcloud.nix @@ -15,7 +15,7 @@ enable = true; package = pkgs.nextcloud33; - hostName = "nextcloud.srazka.com"; + hostName = "nextcloud.reudy.net"; https = true; config = { @@ -28,7 +28,7 @@ settings = { trusted_proxies = [ "127.0.0.1" ]; overwriteprotocol = "https"; - overwritehost = "nextcloud.srazka.com"; + overwritehost = "nextcloud.reudy.net"; default_phone_region = "NL"; }; }; diff --git a/panel.nix b/panel.nix index c104b27..1fa6da2 100644 --- a/panel.nix +++ b/panel.nix @@ -65,7 +65,7 @@ in }; }; - services.caddy.virtualHosts."panel.srazka.com".extraConfig = '' + services.caddy.virtualHosts."panel.reudy.net".extraConfig = '' forward_auth 127.0.0.1:9091 { uri /api/authz/forward-auth copy_headers Remote-User Remote-Groups Remote-Email Remote-Name diff --git a/panel/API.md b/panel/API.md index 298faea..62912a6 100644 --- a/panel/API.md +++ b/panel/API.md @@ -67,10 +67,10 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`. ```json { "name": "blog", - "routes": [{"domain": "blog.srazka.com", "upstream": "127.0.0.1:18090"}], + "routes": [{"domain": "blog.reudy.net", "upstream": "127.0.0.1:18090"}], "auth": true, "source_type": "git", - "repo_url": "https://git.srazka.com/reudy-net/blog.git", + "repo_url": "https://git.reudy.net/reudy-net/blog.git", "repo_branch": "", "use_forgejo_token": true, "env": [{"key": "DATABASE_URL", "value": "postgres://..."}], @@ -108,7 +108,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`. "apps": [ { "name": "whoami", - "routes": [{"domain": "whoami.srazka.com", "upstream": "127.0.0.1:18080"}], + "routes": [{"domain": "whoami.reudy.net", "upstream": "127.0.0.1:18080"}], "auth": true, "compose_file": "/var/lib/containers/stacks/whoami/compose.yaml", "repo_url": "", @@ -136,7 +136,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`. { "name": "whoami", "routes": [ - {"domain": "whoami.srazka.com", "upstream": "127.0.0.1:18080"} + {"domain": "whoami.reudy.net", "upstream": "127.0.0.1:18080"} ], "auth": true } @@ -148,8 +148,8 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`. { "name": "myapp", "routes": [ - {"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"}, - {"domain": "api.app.srazka.com", "upstream": "127.0.0.1:18081"} + {"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"}, + {"domain": "api.app.reudy.net", "upstream": "127.0.0.1:18081"} ], "auth": true } @@ -161,7 +161,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`. { "name": "pocketbase", "routes": [ - {"domain": "pb.srazka.com", "upstream": "127.0.0.1:8090", "path": "/_/*"} + {"domain": "pb.reudy.net", "upstream": "127.0.0.1:8090", "path": "/_/*"} ], "auth": true } @@ -175,7 +175,7 @@ The `path` field is optional. When present, it generates a Caddy `reverse_proxy { "name": "wildcard", "routes": [ - {"domain": "*.srazka.com", "upstream": "127.0.0.1:18082"} + {"domain": "*.reudy.net", "upstream": "127.0.0.1:18082"} ], "auth": false } @@ -188,9 +188,9 @@ Note: Wildcard domains require DNS challenge configuration in Caddy. ```json { "routes": [ - {"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"}, - {"domain": "api.srazka.com", "upstream": "127.0.0.1:18081"}, - {"domain": "pb.srazka.com", "upstream": "127.0.0.1:8090", "path": "/_/*"} + {"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"}, + {"domain": "api.reudy.net", "upstream": "127.0.0.1:18081"}, + {"domain": "pb.reudy.net", "upstream": "127.0.0.1:8090", "path": "/_/*"} ] } ``` @@ -230,8 +230,8 @@ Caddy reloads automatically via the systemd path watcher. Containers stay runnin "ok": true, "name": "myapp", "routes": [ - {"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"}, - {"domain": "api.srazka.com", "upstream": "127.0.0.1:18081", "path": "/api/*"} + {"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"}, + {"domain": "api.reudy.net", "upstream": "127.0.0.1:18081", "path": "/api/*"} ] } ``` diff --git a/panel/README.md b/panel/README.md index 5f9cc49..eb98901 100644 --- a/panel/README.md +++ b/panel/README.md @@ -25,16 +25,16 @@ All app routes are written to a single `routes/routes.caddy` file that Caddy imp # Routes are "domain|upstream[|path]" entries, comma-separated. # Create a new app (single route, protected by Authelia) -panelctl init whoami "whoami.srazka.com|127.0.0.1:18080" true +panelctl init whoami "whoami.reudy.net|127.0.0.1:18080" true # Create with multiple routes (different ports, optional path) -panelctl init myapp "app.srazka.com|127.0.0.1:18081,api.srazka.com|127.0.0.1:18082|/api/*" true +panelctl init myapp "app.reudy.net|127.0.0.1:18081,api.reudy.net|127.0.0.1:18082|/api/*" true # Create with wildcard domain (requires DNS challenge in Caddy) -panelctl init wild "*.srazka.com|127.0.0.1:18083" false +panelctl init wild "*.reudy.net|127.0.0.1:18083" false # Change routes later (Caddy reloads automatically) -panelctl set-routes whoami "whoami.srazka.com|127.0.0.1:18080,who.srazka.com|127.0.0.1:18080" +panelctl set-routes whoami "whoami.reudy.net|127.0.0.1:18080,who.reudy.net|127.0.0.1:18080" # Deploy (compose up + caddy reload) panelctl deploy whoami @@ -90,8 +90,8 @@ panelctl remove whoami ## Web UI & API - Nix runs `panel-api` as a systemd service on `127.0.0.1:9911`. -- Caddy proxies `https://panel.srazka.com` → panel-api with Authelia forward_auth. -- Open `https://panel.srazka.com` for the web UI. +- Caddy proxies `https://panel.reudy.net` → panel-api with Authelia forward_auth. +- Open `https://panel.reudy.net` for the web UI. - API docs: [API.md](API.md) ### Web UI features @@ -130,7 +130,9 @@ Forgejo. The token is stored in `state/panel/forgejo-token` (mode 0600). `state/panel/ssh/` the first time it is needed. Its public half is shown in Settings (and next to ssh URLs); add it as a read-only deploy key to a repository — or to your Forgejo account for access to all repositories — to -clone `ssh://git@git.srazka.com:14922/owner/repo.git` style URLs. **Sync** fetches the configured branch and +clone `ssh://git@git.reudy.net:14922/owner/repo.git` style URLs. + +**Sync** fetches the configured branch and hard-resets the checkout to it before redeploying, so the repository is the source of truth: compose edits made in the panel are discarded on the next sync (the UI warns about this). An access token for a private repository is stored in diff --git a/panel/panelctl.sh b/panel/panelctl.sh index 4e9d056..3a6c540 100644 --- a/panel/panelctl.sh +++ b/panel/panelctl.sh @@ -78,7 +78,7 @@ Wildcard domains are supported (requires DNS challenge in Caddy): panelctl init myapp "*.example.com|127.0.0.1:18080" true Examples: - panelctl init whoami "whoami.srazka.com|127.0.0.1:18080" true + panelctl init whoami "whoami.reudy.net|127.0.0.1:18080" true panelctl deploy whoami panelctl restart whoami panelctl status whoami -- 2.51.2