From 31c444829d9fed74b9dcf844262b15734ac7be85 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Sun, 14 Jun 2026 09:23:03 +0000
Subject: [PATCH] =?UTF-8?q?setup.sh:=20fix=20wildcard=20Caddy=20block=20?=
 =?UTF-8?q?=E2=80=94=20use=20host=20label=20placeholder=20(host=5Fregexp?=
 =?UTF-8?q?=20isn't=20a=20built-in=20matcher)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

caddy validate failed: 'module not registered: http.matchers.host_regexp'.
Drop the regexp; map the subdomain via {http.request.host.labels.N} where N is
the DOMAIN label count. The on-demand ask endpoint still gates cert issuance to
registered members.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 setup.sh | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/setup.sh b/setup.sh
index 769d472..026f539 100755
--- a/setup.sh
+++ b/setup.sh
@@ -381,7 +381,9 @@ fi
 # Let Caddy (user 'caddy') read the per-user public_html trees.
 usermod -aG "$SVC_USER" caddy 2>/dev/null || true
 log "writing Caddyfile"
-DOMAIN_RE=$(printf '%s' "$DOMAIN" | sed 's/[.]/\\./g')   # dots escaped for Caddy host_regexp
+# Caddy indexes host labels from the right (com=0, profullstack=1, bbs=2, …);
+# the user subdomain is the next label left, i.e. index = DOMAIN's label count.
+USER_LABEL_IDX=$(printf '%s' "$DOMAIN" | awk -F. '{print NF}')
 cat > /etc/caddy/Caddyfile <<CADDY
 {
 	email ${ACME_EMAIL}
@@ -427,15 +429,11 @@ ${DOMAIN} {
 	tls {
 		on_demand
 	}
-	@user host_regexp user ^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.${DOMAIN_RE}\$
-	handle @user {
-		root * ${DATA_DIR}/users/{re.user.1}/public_html
-		try_files {path} {path}/index.html
-		file_server browse
-	}
-	handle {
-		respond "no such user" 404
-	}
+	# Only registered members get an on-demand cert (the ask endpoint gates it),
+	# so {labels.${USER_LABEL_IDX}} is always a real user's public_html.
+	root * ${DATA_DIR}/users/{http.request.host.labels.${USER_LABEL_IDX}}/public_html
+	try_files {path} {path}/index.html
+	file_server browse
 }
 
 # Custom domains a member pointed at this host (ssh domain@${DOMAIN} add ...).