relay caddy front#240

Open

atomikpanda wants to merge 10 commits into

mainfrom

feat/relay-caddy-front

Commits on Jun 26, 2026

plan: relay Caddy front (enroll behind 443, on-demand TLS ask)
atomikpanda
committed
relay: add tls_ask_allowed cert allowlist predicate
atomikpanda
committed
relay: pin tls_ask bypass-critical behaviors with regression tests
atomikpanda
committed
relay: enroll app serves Caddy on-demand /tls-check ask route
atomikpanda
committed
relay: enroll-server binds loopback + takes --relay-domain for the ask route
atomikpanda
committed
relay: enroll derives https://enroll.<relay-host>; --enroll-url now optional override
atomikpanda
committed
relay: front sish with Caddy (on-demand TLS ask, enroll behind 443, loopback enroll-server)
atomikpanda
committed
docs: relay Caddy front + https://enroll.<host> enroll flow
atomikpanda
committed
relay: fix bootstrap dirs (caddy-data/config, drop acme) + docs probe route
atomikpanda
committed
relay: supervise enroll-server (backs Caddy TLS ask) + tighten serve-label regex (greptile P1/P2)
atomikpanda
committed