infrastructure/mw-pfeddersheim-workstation
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(caddy): add agent0.localhost reverse proxy + RFC 6761 wildcard learning

Browse Source 
- New site: https://agent0.localhost -> reverse_proxy 192.168.0.141:8090
  (first non-localhost backend; remote LAN host running uvicorn)
- Config in dedicated /etc/caddy/conf.d/agent0.localhost.conf
- Regenerated mkcert cert: 19 -> 20 SANs, valid until 2028-10-21
- Key learning: *.localhost wildcard is NOT honored by curl/system
  trust even for single-label subdomains - .localhost is a special-use
  TLD per RFC 6761; every subdomain needs an explicit SAN. Corrects
  prior assumption in stack.md and manual-overrides.md.

Updates: docs/tech/stack.md, docs/tech/manual-overrides.md, CHANGELOG.md
This commit is contained in:
mw
2026-07-21 14:08:07 +02:00
parent c67dd74e0b
commit cd63df4f59
3 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tech/stack.md
+9 -6
View File
@@ -106,10 +106,10 @@ for the active Caddy/OnlyOffice investigation.
|------|-------|
| Package | `caddy` (pacman) |
| Service | `caddy.service` (enabled, runs as `caddy` user) |
| Config | `/etc/caddy/Caddyfile` + `/etc/caddy/conf.d/localhost-dev.conf` |
| TLS cert | mkcert-generated pair at `/etc/caddy/localhost{,-key}.pem`; includes explicit SANs for all 19 hostnames (wildcard `*.localhost` only covers single-label subdomains like `mcp.localhost`; multi-label hosts like `onlyoffice.docs.localhost` and `demo.satware.com.localhost` require explicit SANs) |
| Config | `/etc/caddy/Caddyfile` + `/etc/caddy/conf.d/*.conf` (main site file `localhost-dev.conf`, plus per-service files like `agent0.localhost.conf`) |
| TLS cert | mkcert-generated pair at `/etc/caddy/localhost{,-key}.pem`; includes explicit SANs for all 20 hostnames, valid until 2028-10-21. The `*.localhost` wildcard is NOT honored by curl/system trust even for single-label subdomains like `agent0.localhost` (empirically verified 2026-07-21: `.localhost` is a special-use TLD per RFC 6761); every subdomain MUST be listed explicitly. Multi-label hosts like `onlyoffice.docs.localhost` additionally require explicit SANs because wildcards only cover one level. |
| Admin endpoint | Unix socket `/run/caddy/admin.socket` |
| Sites | 17 `*.localhost` virtual hosts (see table below) |
| Sites | 18 `*.localhost` virtual hosts (see table below) |
#### `*.localhost` sites
@@ -123,10 +123,13 @@ for the active Caddy/OnlyOffice investigation.
| `platform.localhost` | `reverse_proxy localhost:10080` | amicron-platform Docker (Symfony 7.4 + Vue 3 + Firebird 3.0.14); `~/internal/amicron-platform` |
| `packages.localhost` | `reverse_proxy localhost:20080` | satis Docker (Composer package repository with token-based access control); `~/internal/satis` |
| `onlyoffice.docs.localhost` | `file_server` root `/home/mw/internal/onlyoffice/docs-site/dist` | Starlight static docs build |
| `agent0.localhost` | `reverse_proxy 192.168.0.141:8090` | First non-localhost backend (remote host on LAN, uvicorn app). Config in dedicated `/etc/caddy/conf.d/agent0.localhost.conf`. `flush_interval -1` enabled. |
Wildcard `*.localhost` only matches single-label subdomains (e.g. `mcp.localhost`).
Multi-label hosts like `onlyoffice.docs.localhost` and `demo.satware.com.localhost`
require explicit SANs in the mkcert cert - they are NOT covered by the wildcard.
Wildcard `*.localhost` only matches single-label subdomains (e.g. `mcp.localhost`)
AND is not honored by curl/system trust for the `.localhost` special-use TLD
(RFC 6761) - every subdomain needs an explicit SAN. Multi-label hosts like
`onlyoffice.docs.localhost` and `demo.satware.com.localhost` require explicit
SANs for both reasons.
### Useful Caddy commands