0042: Keel Web sites, implementation (keel renders the sites) #51

New issue

Open

opened 2026-10-02 01:32:32 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-02 01:32:32 -03:00

(Migrated from github.com)

Implementation of handbook decision 0042 (Keel Web sites): keel renders sites-available/keel-<site>.conf and the stream front from web.sites, with per-site tls.certificate, redirect_http, tls.hsts, protect.waf and protect.anubis.

Follow-ups recorded in Keel-Linux/keel-web#3 for when this lands:

HSTS: emit it once the site's certificate is a CA's (ACME issued), never over the self-signed default (0042, tls.hsts). keel-web's default-anubis has no HSTS today.
Passthrough: a tls-passthrough site needs the stream front on 443, so the direct listen 443 of default-anubis must go (0042, stream topology); the default site then moves behind unix:/run/nginx/keel-https.sock.
Anubis REDIRECT_DOMAINS becomes the sites' names instead of the machine's names and addresses.

Implementation of handbook decision 0042 (Keel Web sites): keel renders `sites-available/keel-<site>.conf` and the stream front from `web.sites`, with per-site `tls.certificate`, `redirect_http`, `tls.hsts`, `protect.waf` and `protect.anubis`. Follow-ups recorded in Keel-Linux/keel-web#3 for when this lands: - HSTS: emit it once the site's certificate is a CA's (ACME issued), never over the self-signed default (0042, `tls.hsts`). keel-web's `default-anubis` has no HSTS today. - Passthrough: a `tls-passthrough` site needs the stream front on 443, so the direct `listen 443` of `default-anubis` must go (0042, stream topology); the default site then moves behind `unix:/run/nginx/keel-https.sock`. - Anubis `REDIRECT_DOMAINS` becomes the sites' `names` instead of the machine's names and addresses.