#!/bin/mkpkg
# description: Fast, extensible web server with automatic HTTPS
# url: https://caddyserver.com/

name=caddy
version=2.11.4
release=2
makedeps=(go)
groups=(caddy:user:caddy:/var/lib/caddy:750)
services=(caddy)
capabilities=(
    /usr/bin/caddy:cap_net_bind_service+ep
)
permissions=(
    /etc/caddy:root:caddy:750
    /etc/caddy/Caddyfile:root:caddy:640
    /var/lib/caddy:caddy:caddy:750
    /var/lib/caddy/www:caddy:caddy:750
)

source=(https://github.com/caddyserver/$name/archive/refs/tags/v$version.tar.gz)
renames=($name-$version.tar.gz)
sha256sums=(
    "2c3d02078286a6282cdb4d1d8744077788d556659dac0b64d8ed5886a7e5aeb9"
)

build() {
    cd $name-$version
    export GOFLAGS="-trimpath -mod=readonly -v"
    export GOTOOLCHAIN=local    # do not fetch a toolchain from the module proxy

    # caddy.Version() reads module info from debug.ReadBuildInfo(). A tarball
    # build has no VCS metadata, so the version falls back to CustomVersion.
    go build \
        -ldflags "-s -w -X github.com/caddyserver/caddy/v2.CustomVersion=v$version" \
        -o bin/caddy \
        ./cmd/caddy

    install -Dm755 bin/caddy $PKG/usr/bin/caddy

    # man pages, generated by the freshly built binary (section 8)
    ./bin/caddy manpage --directory docs/man
    mandir="$PKG/usr/share/man"
    for f in docs/man/caddy*.8; do
        install -Dm644 "$f" "$mandir/man8/$(basename $f)"
    done

    # Config directory
    install -d -m 750 $PKG/etc/caddy

    printf '%s\n' \
        '# rawnix Caddy configuration' \
        '# See https://caddyserver.com/docs/caddyfile' \
        '' \
        '{' \
        '	# Admin API, loopback only' \
        '	admin localhost:2019' \
        '' \
        '	# ACME account address for automatic HTTPS' \
        '	# email admin@example.org' \
        '}' \
        '' \
        '# The default site listens on an unprivileged port because the service' \
        '# runs as the caddy user. To serve a real domain with automatic HTTPS' \
        '# on :80/:443 see the note in /etc/sv/caddy/run.' \
        '#' \
        '#	example.org {' \
        '#		root * /var/lib/caddy/www' \
        '#		file_server' \
        '#		encode zstd gzip' \
        '#	}' \
        '' \
        ':8080 {' \
        '	root * /var/lib/caddy/www' \
        '	file_server' \
        '	encode zstd gzip' \
        '' \
        '	header {' \
        '		X-Content-Type-Options nosniff' \
        '		X-Frame-Options DENY' \
        '		Referrer-Policy strict-origin-when-cross-origin' \
        '		-Server' \
        '	}' \
        '' \
        '	log {' \
        '		output stderr' \
        '		format console' \
        '	}' \
        '}' \
        > $PKG/etc/caddy/Caddyfile

    # State directory: certificates, OCSP staples, autosave.json, docroot
    install -d -m 750 $PKG/var/lib/caddy
    install -d -m 750 $PKG/var/lib/caddy/www
}

post_build() {
    # runit service
    install -d $PKG/etc/sv/caddy/log

    printf '%s\n' \
        '#!/bin/sh' \
        'exec 2>&1' \
        '' \
        '# Certificates, OCSP staples and autosave.json live under /var/lib/caddy' \
        '# so that /etc/caddy stays read-only for the service user.' \
        'export HOME=/var/lib/caddy' \
        'export XDG_DATA_HOME=/var/lib/caddy' \
        'export XDG_CONFIG_HOME=/var/lib/caddy' \
        '' \
        '# Prepare runtime directories (/var/lib/caddy ownership comes from' \
        '# the package permissions= directive)' \
        'install -d -m 750 -o caddy -g caddy /run/caddy' \
        '' \
        '# Validate as the user that will run the server: provisioning the tls' \
        '# app can populate XDG_DATA_HOME, and root-owned files there would be' \
        '# unusable at renewal time.' \
        'chpst -u caddy:caddy caddy validate --adapter caddyfile --config /etc/caddy/Caddyfile || exit 1' \
        '' \
        '# Binding :80/:443 as the caddy user needs one of:' \
        '#   setcap cap_net_bind_service=+ep /usr/bin/caddy' \
        '#   sysctl net.ipv4.ip_unprivileged_port_start=80' \
        '# Otherwise drop the chpst prefix below and run caddy as root.' \
        'exec chpst -u caddy:caddy caddy run --adapter caddyfile --config /etc/caddy/Caddyfile' \
        > $PKG/etc/sv/caddy/run

    printf '%s\n' \
        '#!/bin/sh' \
        'mkdir -p /var/log/caddy' \
        'exec svlogd -tt /var/log/caddy' \
        > $PKG/etc/sv/caddy/log/run

    printf '%s\n' \
        '#!/bin/sh' \
        'rm -rf /run/caddy' \
        > $PKG/etc/sv/caddy/finish

    chmod 755 $PKG/etc/sv/caddy/run
    chmod 755 $PKG/etc/sv/caddy/log/run
    chmod 755 $PKG/etc/sv/caddy/finish

    # Service disabled by default - edit the Caddyfile, then: rm /etc/sv/caddy/down
    touch $PKG/etc/sv/caddy/down
}

signify() {
    untrusted comment: public key
    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}

# vim: filetype=sh