wild-cloud/wild-pc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fix stale TLS/routing references (audit sweep)

Browse Source 
Cross-checked every doc against the code and fixed the stragglers the
apply/gateway/subdomain refactors left behind:

- Retired `tls: internal` mode: dropped the misleading reference in
  registry.md and the stale comment in config.py GatewayConfig (only
  off|acme exist; the dns-and-tls.md "was removed" note is kept as
  accurate history).
- Subdomain-only routing: fixed "path-based routing" claims in design.md
  (proxy list + mesh), "path prefix or host" → host, and the "path-prefix
  routes stay on :port" line in registry.md.
- Frontends serve at their subdomain root (VITE_BASE=/), not /<name>/:
  fixed supabase.md (x2), the scaffold.py docstring, the stacks.py build
  comment, and design.md's "serve prefix baked in" line.

README, AGENTS, developing-castle, dns-and-tls audited clean. Verified
against code; core 129 / cli 31 pass; ruff clean.
This commit is contained in:
Paul Payne
2026-07-02 13:56:41 -07:00
parent 43a6ad76bb
commit 0e8bf2571f
7 changed files with 21 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/registry.md
View File

@@ -395,8 +395,8 @@ version number"). `gateway.tls` has two values:
| `off` (default/unset) | `:<port>` HTTP, `auto_https off` | host matcher on `:<port>` | none |
| `acme` | one `*.<domain>` `:443` site | matcher inside the wildcard site | **real Let's Encrypt wildcard, no CA install** |
Path-prefix and static routes always stay on the HTTP `:<port>` site — the way to
put a service on HTTPS is to set `proxy: true` (and use acme mode). A node with no public
In `off` mode all routes stay on the HTTP `:<port>` site — the way to put a
service on HTTPS is to set `proxy: true` (and use acme mode). A node with no public
domain stays on `off` (plain HTTP; use `localhost`/direct ports for anything that
needs a secure context).
@@ -413,9 +413,10 @@ the floor once: `net.ipv4.ip_unprivileged_port_start=80` (persist in
#### Publicly-trusted HTTPS — `gateway.tls: acme`
A private-CA approach (Caddy's `tls internal`) forces every client device to trust
a custom root — which some platforms (e.g. Android browsers, and Firefox, which
uses its own store) make painful. `acme` mode avoids it entirely: Caddy obtains a
A private-CA approach would force every client device to trust a custom root —
which some platforms (e.g. Android browsers, and Firefox, which uses its own
store) make painful — so Castle doesn't offer one. `acme` mode avoids it entirely:
Caddy obtains a
**real Let's Encrypt wildcard cert** (`*.<domain>`) via a **DNS-01** challenge, so
every browser trusts it with **zero CA install** — while the services stay
**internal-only**.