Initial commit

reverse-proxy/Caddyfile.example

@@ -0,0 +1,30 @@
+# Reference config for the CENTRAL REVERSE PROXY MACHINE — not for this host.
+# This stack publishes plain HTTP on <notes-host>:5233; TLS terminates here.
+#
+# Replace notes-host.lan with the LAN address of the machine running the
+# markdown-to-caldav stack.
+
+# --- Option A: its own hostname ---------------------------------------------
+
+notes.example.com {
+	encode zstd gzip
+	reverse_proxy notes-host.lan:5233
+}
+
+# --- Option B: share a hostname with an existing Radicale -------------------
+#
+# `handle` (not `handle_path`) keeps the /notes prefix in the request: Radicale
+# strips script_name itself and re-adds it when generating hrefs. Stripping at
+# the proxy instead yields hrefs missing the prefix, and clients then walk to
+# collection URLs that do not exist.
+#
+# dav.example.com {
+# 	handle /notes/* {
+# 		reverse_proxy notes-host.lan:5233 {
+# 			header_up X-Script-Name /notes
+# 		}
+# 	}
+# 	handle {
+# 		reverse_proxy existing-radicale.lan:5232
+# 	}
+# }

reverse-proxy/nginx.conf.example

@@ -0,0 +1,54 @@
+# Reference config for the CENTRAL REVERSE PROXY MACHINE — not for this host.
+# This stack publishes plain HTTP on <notes-host>:5233; TLS terminates here.
+#
+# Replace notes-host.lan with the LAN address of the machine running the
+# markdown-to-caldav stack.
+
+upstream mdcaldav {
+    server notes-host.lan:5233;
+}
+
+# --- Option A: its own hostname ---------------------------------------------
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name notes.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/notes.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/notes.example.com/privkey.pem;
+
+    # CalDAV bodies are small, but clients send large PROPFIND/REPORT XML.
+    client_max_body_size 100M;
+
+    location / {
+        proxy_pass http://mdcaldav;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# --- Option B: share a hostname with an existing Radicale -------------------
+#
+# NOTE the absence of a trailing slash on proxy_pass. With a trailing slash
+# nginx replaces the /notes/ prefix with /, Radicale then generates hrefs
+# without the prefix, and clients walk to URLs that do not exist. Radicale
+# strips script_name itself, so send it the full path.
+#
+# server {
+#     listen 443 ssl;
+#     server_name dav.example.com;
+#
+#     location /notes/ {
+#         proxy_pass http://mdcaldav;              # no trailing slash
+#         proxy_set_header X-Script-Name     /notes;
+#         proxy_set_header Host              $host;
+#         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+#
+#     location / {
+#         proxy_pass http://existing-radicale.lan:5232;
+#     }
+# }