blob: 341b97cc208f5c091020cd7340f5ff102454e1b8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
#!/bin/mkpkg
# description: Fast, extensible web server with automatic HTTPS
# url: https://caddyserver.com/
name=caddy
version=2.11.4
release=2
makedeps=(go)
groups=(caddy:user:caddy:/var/lib/caddy:750)
services=(caddy)
capabilities=(
/usr/bin/caddy:cap_net_bind_service+ep
)
permissions=(
/etc/caddy:root:caddy:750
/etc/caddy/Caddyfile:root:caddy:640
/var/lib/caddy:caddy:caddy:750
/var/lib/caddy/www:caddy:caddy:750
)
source=(https://github.com/caddyserver/$name/archive/refs/tags/v$version.tar.gz)
renames=($name-$version.tar.gz)
sha256sums=(
"2c3d02078286a6282cdb4d1d8744077788d556659dac0b64d8ed5886a7e5aeb9"
)
build() {
cd $name-$version
export GOFLAGS="-trimpath -mod=readonly -v"
export GOTOOLCHAIN=local # do not fetch a toolchain from the module proxy
# caddy.Version() reads module info from debug.ReadBuildInfo(). A tarball
# build has no VCS metadata, so the version falls back to CustomVersion.
go build \
-ldflags "-s -w -X github.com/caddyserver/caddy/v2.CustomVersion=v$version" \
-o bin/caddy \
./cmd/caddy
install -Dm755 bin/caddy $PKG/usr/bin/caddy
# man pages, generated by the freshly built binary (section 8)
./bin/caddy manpage --directory docs/man
mandir="$PKG/usr/share/man"
for f in docs/man/caddy*.8; do
install -Dm644 "$f" "$mandir/man8/$(basename $f)"
done
# Config directory
install -d -m 750 $PKG/etc/caddy
printf '%s\n' \
'# rawnix Caddy configuration' \
'# See https://caddyserver.com/docs/caddyfile' \
'' \
'{' \
' # Admin API, loopback only' \
' admin localhost:2019' \
'' \
' # ACME account address for automatic HTTPS' \
' # email admin@example.org' \
'}' \
'' \
'# The default site listens on an unprivileged port because the service' \
'# runs as the caddy user. To serve a real domain with automatic HTTPS' \
'# on :80/:443 see the note in /etc/sv/caddy/run.' \
'#' \
'# example.org {' \
'# root * /var/lib/caddy/www' \
'# file_server' \
'# encode zstd gzip' \
'# }' \
'' \
':8080 {' \
' root * /var/lib/caddy/www' \
' file_server' \
' encode zstd gzip' \
'' \
' header {' \
' X-Content-Type-Options nosniff' \
' X-Frame-Options DENY' \
' Referrer-Policy strict-origin-when-cross-origin' \
' -Server' \
' }' \
'' \
' log {' \
' output stderr' \
' format console' \
' }' \
'}' \
> $PKG/etc/caddy/Caddyfile
# State directory: certificates, OCSP staples, autosave.json, docroot
install -d -m 750 $PKG/var/lib/caddy
install -d -m 750 $PKG/var/lib/caddy/www
}
post_build() {
# runit service
install -d $PKG/etc/sv/caddy/log
printf '%s\n' \
'#!/bin/sh' \
'exec 2>&1' \
'' \
'# Certificates, OCSP staples and autosave.json live under /var/lib/caddy' \
'# so that /etc/caddy stays read-only for the service user.' \
'export HOME=/var/lib/caddy' \
'export XDG_DATA_HOME=/var/lib/caddy' \
'export XDG_CONFIG_HOME=/var/lib/caddy' \
'' \
'# Prepare runtime directories (/var/lib/caddy ownership comes from' \
'# the package permissions= directive)' \
'install -d -m 750 -o caddy -g caddy /run/caddy' \
'' \
'# Validate as the user that will run the server: provisioning the tls' \
'# app can populate XDG_DATA_HOME, and root-owned files there would be' \
'# unusable at renewal time.' \
'chpst -u caddy:caddy caddy validate --adapter caddyfile --config /etc/caddy/Caddyfile || exit 1' \
'' \
'# Binding :80/:443 as the caddy user needs one of:' \
'# setcap cap_net_bind_service=+ep /usr/bin/caddy' \
'# sysctl net.ipv4.ip_unprivileged_port_start=80' \
'# Otherwise drop the chpst prefix below and run caddy as root.' \
'exec chpst -u caddy:caddy caddy run --adapter caddyfile --config /etc/caddy/Caddyfile' \
> $PKG/etc/sv/caddy/run
printf '%s\n' \
'#!/bin/sh' \
'mkdir -p /var/log/caddy' \
'exec svlogd -tt /var/log/caddy' \
> $PKG/etc/sv/caddy/log/run
printf '%s\n' \
'#!/bin/sh' \
'rm -rf /run/caddy' \
> $PKG/etc/sv/caddy/finish
chmod 755 $PKG/etc/sv/caddy/run
chmod 755 $PKG/etc/sv/caddy/log/run
chmod 755 $PKG/etc/sv/caddy/finish
# Service disabled by default - edit the Caddyfile, then: rm /etc/sv/caddy/down
touch $PKG/etc/sv/caddy/down
}
signify() {
untrusted comment: public key
RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}
# vim: filetype=sh
|
