From 8c8ee6b4be7aa9790fbbe7ecfbab307a52b02b4d Mon Sep 17 00:00:00 2001
From: Jannik <jannik@orfel.de>
Date: Thu, 1 Oct 2026 17:11:10 +0200
Subject: [PATCH] Clean initial state: removed all wrapper scripts and debug
 code. deploy_script.sh and the dev server are the only files that should
 drive the next deploy.

---
 .gitignore                         | 32 ++++++++++++++++++++++++++++++
 keys/age-public-key.txt            |  1 +
 services/caddy/Caddyfile           |  9 +++++++++
 services/caddy/README.md           | 24 ++++++++++++++++++++++
 services/caddy/docker-compose.yml  | 30 ++++++++++++++++++++++++++++
 services/caddy/resolv.conf         |  9 +++++++++
 services/caddy/service.enabled     |  1 +
 services/caddy/service.init        | 21 ++++++++++++++++++++
 services/paperclip/service.enabled |  1 +
 9 files changed, 128 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 keys/age-public-key.txt
 create mode 100644 services/caddy/Caddyfile
 create mode 100644 services/caddy/README.md
 create mode 100644 services/caddy/docker-compose.yml
 create mode 100644 services/caddy/resolv.conf
 create mode 100644 services/caddy/service.enabled
 create mode 100755 services/caddy/service.init
 create mode 100644 services/paperclip/service.enabled

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..6538287
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,32 @@
+# Environment files (contain secrets)
+**/.env
+
+# AGE private key (never commit)
+**/age-key.txt
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor files
+*.swp
+*.swo
+*~
+.vscode/
+.idea/
+
+# Temporary scratch folder
+scratch/
+
+# Generated additions
+temp.txt
+*.tmp
+*.log
+.venv/
+
+# Caddy fragments directory (assembled by deploy_script.sh from each service's *.caddy)
+services/caddy/fragments/
+
+# Local docker save backups (don't accidentally commit these — too big)
+paperclip-image.tar
+paperclip-image.tar.gz
diff --git a/keys/age-public-key.txt b/keys/age-public-key.txt
new file mode 100644
index 0000000..152a924
--- /dev/null
+++ b/keys/age-public-key.txt
@@ -0,0 +1 @@
+age1sa3q5qxl5dylld7v839m9lkv5h7l457wq4h40pt7kfmcfhcqkfjqspdjpn
diff --git a/services/caddy/Caddyfile b/services/caddy/Caddyfile
new file mode 100644
index 0000000..c3d46ad
--- /dev/null
+++ b/services/caddy/Caddyfile
@@ -0,0 +1,9 @@
+{
+    # Caddy global options
+    # admin off disables the admin API endpoint (security)
+    admin off
+}
+
+# Import all service-specific reverse-proxy fragments.
+# The deploy_script.sh assembles these from services/*/*.caddy at every run.
+import /etc/caddy/fragments/*.caddy
diff --git a/services/caddy/README.md b/services/caddy/README.md
new file mode 100644
index 0000000..0a70a80
--- /dev/null
+++ b/services/caddy/README.md
@@ -0,0 +1,24 @@
+# Caddy Reverse Proxy
+
+Caddy container that terminates HTTPS (Let's Encrypt) and routes traffic to PaperClip.
+
+## How it works
+
+- `docker-compose.yml` mounts `/mnt/Jannik-Cloud-Volume-01/caddy/` into the container:
+  - `Caddyfile` — main config, imports all `*.caddy` fragments from `fragments/`
+  - `fragments/` — per-service reverse-proxy definitions, assembled by `deploy_script.sh`
+  - `data/`, `config/` — Caddy cert + state storage
+- Only ports 80 and 443 are exposed to the host
+- PaperClip itself binds only on the internal `paperclip-net` Docker network
+
+## Adding new subdomains
+
+Drop a `<name>.caddy` file into `services/<name>/` with:
+
+```caddyfile
+subdomain.orfel.de {
+    reverse_proxy <container-name>:<port>
+}
+```
+
+The deploy script picks it up automatically.
diff --git a/services/caddy/docker-compose.yml b/services/caddy/docker-compose.yml
new file mode 100644
index 0000000..18a8a19
--- /dev/null
+++ b/services/caddy/docker-compose.yml
@@ -0,0 +1,30 @@
+services:
+  caddy:
+    image: caddy:2-alpine
+    container_name: caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    # Mount a custom resolv.conf that has BOTH Docker's embedded DNS
+    # (127.0.0.11, for service discovery of 'postgres' and 'paperclip')
+    # AND public IPv6-capable resolvers (for ACME's letsencrypt.org).
+    # Don't use docker-compose's `dns:` option — it REPLACES the default
+    # 127.0.0.11 entry, breaking service discovery.
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./fragments:/etc/caddy/fragments:ro
+      - ./resolv.conf:/etc/resolv.conf:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    networks:
+      - paperclip-net
+
+
+networks:
+  paperclip-net:
+    external: true
+
+volumes:
+  caddy_data:
+  caddy_config:
diff --git a/services/caddy/resolv.conf b/services/caddy/resolv.conf
new file mode 100644
index 0000000..388bc82
--- /dev/null
+++ b/services/caddy/resolv.conf
@@ -0,0 +1,9 @@
+# Used by both Caddy and Paperclip containers on the IPv6-only host.
+# - 127.0.0.11 = Docker's embedded DNS for service discovery (postgres, paperclip)
+# - 1.1.1.1, 8.8.8.8, and 2606:4700:4700::1111 = public DNS for external hosts
+#   (acme-v02.api.letsencrypt.org, registry.npmjs.org, etc.)
+nameserver 127.0.0.11
+nameserver 1.1.1.1
+nameserver 8.8.8.8
+nameserver 2606:4700:4700::1111
+options edns0 trust-ad ndots:0
diff --git a/services/caddy/service.enabled b/services/caddy/service.enabled
new file mode 100644
index 0000000..dbdd56a
--- /dev/null
+++ b/services/caddy/service.enabled
@@ -0,0 +1 @@
+This file enables the service for deployment.
diff --git a/services/caddy/service.init b/services/caddy/service.init
new file mode 100755
index 0000000..ed23a90
--- /dev/null
+++ b/services/caddy/service.init
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+###############################################################################
+# caddy service.init — runs before Caddy container starts
+# Ensures the Caddyfile and fragments/ directory exist where the container
+# expects them (relative to this service directory).
+###############################################################################
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+FRAGMENTS_DIR="${SCRIPT_DIR}/fragments"
+
+log() { echo -e "\e[32m[CADDY-INIT]\e[0m $*"; }
+
+mkdir -p "${FRAGMENTS_DIR}"
+log "Fragments directory ready: ${FRAGMENTS_DIR}"
+
+if [[ ! -f "${SCRIPT_DIR}/Caddyfile" ]]; then
+    echo -e "\e[31m[CADDY-INIT][ERROR]\e[0m Caddyfile missing at ${SCRIPT_DIR}/Caddyfile"
+    exit 1
+fi
+log "Caddyfile present at ${SCRIPT_DIR}/Caddyfile"
diff --git a/services/paperclip/service.enabled b/services/paperclip/service.enabled
new file mode 100644
index 0000000..dbdd56a
--- /dev/null
+++ b/services/paperclip/service.enabled
@@ -0,0 +1 @@
+This file enables the service for deployment.