From 4ad426957914dc686334f5c862411c9e0f42bf48 Mon Sep 17 00:00:00 2001 From: FatNine Date: Fri, 21 Aug 2026 22:57:12 +0800 Subject: [PATCH] chore(deploy): sync Caddyfile.tmpl with production config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The template had drifted from /etc/caddy/Caddyfile on the Huawei ECS in two ways — both are live on prod but were missing from the template, so any future reprovision would silently drop them: 1. the /xuedoushan/ static landing-page block (handle_path + file_server) 2. the 2026-08-21 crawler-archive block: 403 */archive/* for the Baidu render bot (fixed Chrome/83.0.4103.106 UA) and meta-externalagent, which ignore robots.txt and were minting .bundle archives for every crawled commit sha (34G in two weeks under data/repo-archive) Template is byte-identical to the production file except the __ACME_EMAIL__ placeholder. No runtime change: prod already runs this exact config. Co-Authored-By: Claude Fable 5 --- deploy/ecs/caddy/Caddyfile.tmpl | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/deploy/ecs/caddy/Caddyfile.tmpl b/deploy/ecs/caddy/Caddyfile.tmpl index 47ab836d0b..0d2cb9192f 100644 --- a/deploy/ecs/caddy/Caddyfile.tmpl +++ b/deploy/ecs/caddy/Caddyfile.tmpl @@ -8,6 +8,32 @@ www.synnovator.com { encode gzip zstd + # 雪窦山 AIGC 品牌出海赛事落地页（静态文件） + redir /xuedoushan /xuedoushan/ 301 + handle_path /xuedoushan/* { + root * /var/lib/hackforger/custom/public/xuedoushan + file_server + } + + # 2026-08-21: block crawler-minted repo archives. Baidu's render bot + # (fixed Chrome/83 UA) and Meta's meta-externalagent ignore robots.txt + # (which already disallows /*/*/archive/ and /*.bundle$) and mint a fresh + # .bundle archive for every commit sha they crawl — 34G in two weeks under + # data/repo-archive plus the git-bundle CPU cost. 403 only on archive + # paths for these two UAs; page crawling is unaffected, legit users on + # other UAs can still download archives. Each matcher ANDs path+UA; + # two matchers give UA-OR. + @archivebot_baidu { + path */archive/* + header User-Agent *Chrome/83.0.4103.106* + } + @archivebot_meta { + path */archive/* + header User-Agent *meta-externalagent* + } + respond @archivebot_baidu 403 + respond @archivebot_meta 403 + # Forward to gitea on loopback. Gitea sees the original Host and X-Forwarded-*. reverse_proxy 127.0.0.1:3000