init

bin/prepare-caddy.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -eu
+
+auth_file=/etc/caddy/auth.caddy
+username="${CADDY_BASIC_AUTH_USERNAME:-}"
+password="${CADDY_BASIC_AUTH_PASSWORD:-}"
+
+if [ -z "$username" ] && [ -z "$password" ]; then
+    : > "$auth_file"
+    exit 0
+fi
+
+if [ -z "$username" ] || [ -z "$password" ]; then
+    printf 'CADDY_BASIC_AUTH_USERNAME and CADDY_BASIC_AUTH_PASSWORD must both be set.\n' >&2
+    exit 1
+fi
+
+case "$username" in
+    *[!A-Za-z0-9._@-]*)
+        printf 'CADDY_BASIC_AUTH_USERNAME contains unsupported characters.\n' >&2
+        exit 1
+        ;;
+esac
+
+password_hash="$(/usr/local/bin/caddy hash-password --plaintext "$password")"
+cat > "$auth_file" <<EOF
+@protected {
+    not path /healthz
+    not path_regexp public ^(/[^/]+/[^/]+\.git/.*|/api/packages(/.*)?)$
+}
+
+basic_auth @protected {
+    $username $password_hash
+}
+EOF