From 8eddc7b6110da9f1da2ffb9321a8a84d80f41c41 Mon Sep 17 00:00:00 2001
From: afterlifepro <vielle.dev@proton.me>
Date: Sun, 23 Aug 2026 15:10:39 +0100
Subject: [PATCH] stop using on demand tls, move {knot,spindle}.vielle.dev to
 {knot,spindle}.abnormal.zip, support nsid and rkey aturi.to urls, add dns
 acme verification support

---
 .gitignore            |  4 ++--
 caddy/Caddyfile       |  9 +++++++--
 caddy/Dockerfile      | 21 +++++++++++++++++++--
 caddy/caddy/atp.caddy | 23 ++++++++++++++++++-----
 compose.yaml          |  3 +--
 5 files changed, 47 insertions(+), 13 deletions(-)

diff --git a/.gitignore b/.gitignore
index 3df1747..d273d15 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
-prs.env
+*.env
 prs.refreshToken
 commit-out.txt
 compose.override.yaml
 *.zip
-!abnormal.zip
\ No newline at end of file
+!abnormal.zip
diff --git a/caddy/Caddyfile b/caddy/Caddyfile
index 1bf33e8..1d6364f 100644
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -1,8 +1,13 @@
 {
 	debug
 	email {$ADMIN_EMAIL:404@vielle.dev}
-	on_demand_tls {
-		ask http://{$ADDR_PDS}/tls-check
+	# on_demand_tls {
+	# 	ask http://{$ADDR_PDS}/tls-check
+	# }
+
+	acme_dns porkbun {
+		api_key {env.PORKBUN_API_KEY}
+		api_secret_key {env.PORKBUN_API_SECRET_KEY}
 	}
 }
 
diff --git a/caddy/Dockerfile b/caddy/Dockerfile
index 3b5fc3b..fb2110a 100644
--- a/caddy/Dockerfile
+++ b/caddy/Dockerfile
@@ -28,11 +28,28 @@ RUN pnpm --dir /app/saltire run build --outDir /app/saltire/dist
 #########
 # CADDY #
 #########
-FROM caddy:2.10.2
+FROM caddy:2.11.4-builder AS build-caddy
+
+RUN --mount=type=cache,target=/go/pkg/mod \
+	--mount=type=cache,target=/root/.cache/go-build \
+	xcaddy build \
+	--with github.com/caddy-dns/porkbun@v0.3.1
+
+########
+# MAIN #
+########
+FROM caddy:2.11.4
+
+COPY --from=build-caddy /usr/bin/caddy /usr/bin/caddy
+
+# config
+COPY ./Caddyfile /etc/caddy/Caddyfile
+COPY ./caddy /etc/caddy/caddy
 
 # copy built files to /srv
 COPY ./srv /srv
 COPY --from=build-dong /app/dong/dist /srv/dong
 COPY --from=build-saltire /app/saltire/dist /srv/saltire
 
-CMD caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
\ No newline at end of file
+
+CMD /usr/bin/caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
\ No newline at end of file
diff --git a/caddy/caddy/atp.caddy b/caddy/caddy/atp.caddy
index 18f7fe5..3fcea7b 100644
--- a/caddy/caddy/atp.caddy
+++ b/caddy/caddy/atp.caddy
@@ -56,11 +56,16 @@
 *.{$PDS_HOST:abnormal.zip},
 *.at.{$DONG_HOST:dongs.zip} {
 	import log pds
-	tls {
-		on_demand
-	}
+	# tls {
+	# 	on_demand
+	# }
+
+	@nsid path_regexp nsid ^/(?<nsid>[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+(\.[a-zA-Z]([a-zA-Z0-9]{0,62})?))/?$
+	@rkey path_regexp rkey ^/(?<nsid>[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+(\.[a-zA-Z]([a-zA-Z0-9]{0,62})?))/(?<rkey>[a-zA-Z0-9.\-_:~]{1,512})/?$
 
 	redir / https://aturi.to/{host}
+	redir @nsid https://aturi.to/explore/{host}/{re.nsid.nsid}
+	redir @rkey https://aturi.to/{host}/{re.rkey.nsid}/{re.rkey.rkey}
 	handle_path /aturi/* { 
 		redir https://aturi.to/at://{host}{uri} 
 	}
@@ -98,7 +103,7 @@
 
 ### tangled knot
 # (see nginx.conf for ssh proxying)
-knot.{$HOST:vielle.dev} {
+knot.{$PDS_HOST:abnormal.zip} {
 	import log knot
 	import favicon abnormal.zip
 	rewrite / /knot
@@ -108,12 +113,20 @@ knot.{$HOST:vielle.dev} {
 	reverse_proxy {$ADDR_KNOT}
 }
 
-spindle.{$HOST:vielle.dev} {
+spindle.{$PDS_HOST:abnormal.zip} {
 	import log spindle
 	import favicon abnormal.zip
 	reverse_proxy {$ADDR_SPINDLE}
 }
 
+knot.{$HOST:vielle.dev} {
+	redir https://knot.{$PDS_HOST:abnormal.zip}{uri}
+}
+
+spindle.{$HOST:vielle.dev} {
+	redir https://spindle.{$PDS_HOST:abnormal.zip}{uri}
+}
+
 ### piper instance
 # technically publicly visible... its _fine_ (+ i cant do jack shit abt it rn so)
 piper.{$HOST:vielle.dev} {
diff --git a/compose.yaml b/compose.yaml
index 9f03933..f58bce0 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -30,10 +30,9 @@ services:
       - 80:80
       - 443:443
     volumes:
-      - ./caddy/Caddyfile:/etc/caddy/Caddyfile
-      - ./caddy/caddy:/etc/caddy/caddy
       - caddy_data:/data
       - caddy_config:/config
+    env_file: ./caddy/caddy.env
     environment:
       HOST: vielle.dev
       DONG_HOST: dongs.zip
-- 
2.51.2