5 Commits

Include renames

Author	SHA1	Message	Date
vasyanskandClaude Sonnet 5.5	e84b79dda0	fix: valid key header bypasses both IP allowlist and PROXY_SECRET check ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-24 14:33:32 +07:00
vasyansk	c144d0967f	feat: add header key auth as alternative to IP allowlist	2026-10-24 14:20:52 +07:00
vasyanskandClaude Opus 5	d71001a2bf	refactor: switch nginx to Caddy with automatic Let's Encrypt ... Nginx required manually managed certs on port 8443; TLS was effectively unused. Caddy issues and renews certificates for DOMAIN on its own. - Caddyfile replaces nginx.conf + locations.conf; upstreams are one `import api <prefix> <host> <path-prefix>` line each - routes wrapped in `route {}` so guards run before handle_path - access control (IP allowlist, X-Proxy-Token) generated from env into matchers.caddy / guard.caddy by the entrypoint, as before - listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the unchanged plain-HTTP 8082 -> 8080 path for existing clients - caddy_data volume added: losing it re-issues certs and burns LE limits - scripts/migrate-host-nginx.sh backs up and retires the host nginx - deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-20 13:35:49 +07:00
vasyansk	b2c7e7ba80	add host	2026-07-09 14:41:17 +07:00
vasyansk	db610976a0	init	2026-03-21 10:47:11 +07:00