admin/authser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Drop Cloudflare DNS TLS block from Caddy vhost

Browse Source 
Remove the tls { dns cloudflare ... } directive and fall back to
Caddy's default automatic HTTPS (HTTP-01 / TLS-ALPN). The
Cloudflare DNS plugin was causing issues during cert provisioning;
standard ACME works fine as long as port 80/443 reach the server.

Also drop the now-unused cloudflare_token variable from group_vars.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Serreau Jovann
2026-04-10 16:48:56 +02:00
parent cad8f5bb91
commit 40c36ef299
2 changed files with 3 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ansible/group_vars/all.yml
View File

@@ -5,10 +5,7 @@ deploy_dir: /var/www/e-auth
auth_domain: auth.e-cosplay.fr auth_domain: auth.e-cosplay.fr
keycloak_local_port: 9450 keycloak_local_port: 9450
# Caddy (assumed already installed with the caddy-dns/cloudflare plugin # Caddy (assumed already installed and configured to load per-site
# and configured to load per-site files from /etc/caddy/sites/*.conf) # files from /etc/caddy/sites/*.conf). TLS is handled by Caddy's
# default ACME flow (HTTP-01 / TLS-ALPN), no Cloudflare DNS plugin.
caddy_site_file: /etc/caddy/sites/e-auth.conf caddy_site_file: /etc/caddy/sites/e-auth.conf
# Cloudflare API token consumed by the caddy-dns/cloudflare plugin
# for the ACME DNS-01 challenge.
cloudflare_token: cfat_rIHZqzCm9GKK3xVnQDNGfu6J91TseIDdTKeuWSFUdf6ccd31

4
ansible/templates/e-auth.conf.j2
View File

@@ -2,10 +2,6 @@
# Reverse proxy for {{ auth_domain }} -> local Keycloak container on :{{ keycloak_local_port }} # Reverse proxy for {{ auth_domain }} -> local Keycloak container on :{{ keycloak_local_port }}
{{ auth_domain }} { {{ auth_domain }} {
tls {
dns cloudflare {{ cloudflare_token }}
}
encode gzip zstd encode gzip zstd
reverse_proxy 127.0.0.1:{{ keycloak_local_port }} reverse_proxy 127.0.0.1:{{ keycloak_local_port }}