From 4572a7739d8e6be9363b1164f52e8026f7ddc0cd Mon Sep 17 00:00:00 2001 From: Frank Date: Sat, 22 Aug 2026 02:44:06 -0700 Subject: [PATCH] Caddy: keep plex.franksdank.casa HTTP-only (not in the Porkbun account) --- dankclaw/Caddyfile | 6 +++++- tests/caddyfile.bats | 9 +++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile index 628b389..718184a 100644 --- a/dankclaw/Caddyfile +++ b/dankclaw/Caddyfile @@ -118,7 +118,11 @@ loki.franksdank.cloud { # ═══════════════════════════════════════════════════════════════ # --- Plex (existing, kept) --- -plex.franksdank.casa { +# http:// on purpose: franksdank.casa is not hosted in the same Porkbun +# account as franksdank.cloud, so the DNS-01 provider cannot issue a +# Let's Encrypt cert for it. It stays plain-HTTP legacy; the canonical +# name is plex.franksdank.cloud (HTTPS, below). +http://plex.franksdank.casa { reverse_proxy 192.168.0.235:32400 } diff --git a/tests/caddyfile.bats b/tests/caddyfile.bats index 2afb4fe..72443bb 100644 --- a/tests/caddyfile.bats +++ b/tests/caddyfile.bats @@ -61,8 +61,13 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile" # --- Phase 2: real TLS via DNS-01 (Porkbun wildcard cert) --- -@test "all vhosts use TLS (no http:// site prefix remains)" { - ! grep -qE '^http://' "$CADDYFILE" +@test "all vhosts use TLS except the legacy .casa name" { + # franksdank.casa is not in the same Porkbun account, so it cannot get + # a DNS-01 Let's Encrypt cert; it stays explicitly http. Every other + # site address must carry no http:// prefix. + local offenders + offenders=$(grep -E '^http://' "$CADDYFILE" | grep -v 'plex\.franksdank\.casa' || true) + [ -z "$offenders" ] || { echo "non-.casa http:// vhosts: $offenders"; return 1; } } @test "the Caddyfile configures the Porkbun DNS-01 provider globally" {