certs: split into smaller certs, update infra layout

docker-compose.yml

@@ -8,17 +8,14 @@ services:
       - /opt/docker/Caddy/Caddyfile:/etc/caddy/Caddyfile:z
       - /vault/services/web/webhosts:/webhosts:z
       - /vault/services/certMgmt/certData/certs:/tls_certs:z
-      - /vault/services/matrix/ssl/config:/matrix_tls_certs:z
       - /vault/services/matrix/static-files:/matrix_static:z
       - /vault/users/jreichmann/public:/public/transcaffeine:z
       - /opt/docker/Caddy/webroot:/var/webroot:z
-      - /vault/services/masto_dark/public:/services/mastodon/public:z
     environment:
       - GID=1001
       - UID=1001
     ports:
-      - "443:443"
-      - "8448:8448"
+      - "192.168.0.53:443:443"
     networks:
       - frontend
       - matrix

webhosts/cloud/Caddyfile

@@ -1,6 +1,6 @@
 https://cloud.finallycoffee.eu {
 	gzip
-	tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+	tls /tls_certs/cloud.finallycoffee.eu/fullchain.pem /tls_certs/cloud.finallycoffee.eu/privkey.pem
 	header / {
 		Referrer-Policy no-referrer
 		Strict-Transport-Security "max-age=15552000;"
@@ -17,7 +17,7 @@ https://cloud.finallycoffee.eu {
 
 https://office.cloud.finallycoffee.eu {
 	gzip
-	tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+	tls /tls_certs/cloud.finallycoffee.eu/fullchain.pem /tls_certs/cloud.finallycoffee.eu/privkey.pem
 	header / {
 		Access-Control-Allow-Origin *
 	}

webhosts/git/Caddyfile

@@ -1,5 +1,5 @@
 https://git.finallycoffee.eu {
-        tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+        tls /tls_certs/git.finallycoffee.eu/fullchain.pem /tls_certs/git.finallycoffee.eu/privkey.pem
         proxy / git:3000 {
                 transparent
                 websocket

webhosts/infra/Caddyfile

@@ -1,5 +1,5 @@
 https://admin.finallycoffee.eu {
-        tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+        tls /tls_certs/admin.finallycoffee.eu/fullchain.pem /tls_certs/admin.finallycoffee.eu/privkey.pem
         proxy / https://172.21.0.1:9090 {
                 transparent
                 websocket
@@ -7,8 +7,13 @@ https://admin.finallycoffee.eu {
         }
 }
 
+https://gateway.finallycoffee.eu {
+        tls /tls_certs/gateway.finallycoffee.eu/fullchain.pem /tls_certs/gateway.finallycoffee.eu/privkey.pem
+
+}
+
 https://dsl.gateway.finallycoffee.eu {
-        tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+        tls /tls_certs/gateway.finallycoffee.eu/fullchain.pem /tls_certs/gateway.finallycoffee.eu/privkey.pem
         basicauth jdreichmann $pass {
                 realm "Intranet karlsruhe.flauschekatze.space"
                 /
@@ -20,7 +25,7 @@ https://dsl.gateway.finallycoffee.eu {
 }
 
 https://docsis.gateway.finallycoffee.eu {
-        tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+        tls /tls_certs/gateway.finallycoffee.eu/fullchain.pem /tls_certs/gateway.finallycoffee.eu/privkey.pem
         basicauth jdreichmann $pass {
                 realm "Intranet karlsruhe.flauschekatze.space"
                 /

webhosts/matrix/Caddyfile

@@ -11,6 +11,11 @@ https://matrix.finallycoffee.eu {
 		header_downstream Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
 		transparent
 	}
+        proxy /_matrix/client/r0/user_directory/search matrix-ma1sd:8090 {
+		header_downstream Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+                header_downstream Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
+                transparent
+	}
 	proxy /_matrix/federation matrix-synapse:8048 {
 		transparent
 	}
@@ -22,6 +27,7 @@ https://matrix.finallycoffee.eu {
 		header_downstream Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
 		transparent
 	}
+	proxy /metrics http://matrix-synapse:9100/_synapse/metrics
 	proxy / https://finallycoffee.eu/.well-known/matrix {
 		except /_matrix
 	}
@@ -41,7 +47,7 @@ https://dimension.matrix.finallycoffee.eu {
 }
 
 https://chat.finallycoffee.eu {
-	tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+	tls /tls_certs/chat.finallycoffee.eu/fullchain.pem /tls_certs/chat.finallycoffee.eu/privkey.pem
 	proxy / http://matrix-riot-web:8080 {
 		transparent
 	}
@@ -61,12 +67,4 @@ https://finallycoffee.eu/.well-known/matrix/ {
 	}
 }
 
-# Federation listens on all IPs because older Synapse versions do not support SNI
-https://:8448 {
-	tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
-	proxy /_matrix matrix-synapse:8048 {
-		transparent
-	}
-}
-