bretton.dev
A community based topic aggregation platform built on atproto
fix(caddy): move the ACME email out of the committed Caddyfile
A personal address in a public repo invites harvesting. The Caddyfile
now takes {$ACME_EMAIL} from the container environment (set in .env,
which never leaves the server); use a role address.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
author
Bretton
co-author
Claude Fable 5
date
(Jul 13, 2026, 9:05 PM -0700)
commit
8ddd4d3c
8ddd4d3c790b696264b8a36f9dcaecbb34fc60e3
parent
a351c983
a351c983a88926e2abbbdb50502fbed27f40b143
+15
-2
+6
.env.prod.example
+6
.env.prod.example
···
166
166
# Template: "Edit zone DNS" with permissions for coves.social zone
167
167
CLOUDFLARE_API_TOKEN=CHANGE_ME_CLOUDFLARE_TOKEN
168
168
169
+
# ACME account email (Let's Encrypt expiry notices; also provisions ZeroSSL
170
+
# as a fallback CA in Caddy 2.8+). Substituted into the Caddyfile's
171
+
# {$ACME_EMAIL} at parse time. Use a ROLE address, never a personal one —
172
+
# the Caddyfile is committed to a public repo, this file is not.
173
+
ACME_EMAIL=support@example.com
174
+
169
175
# =============================================================================
170
176
# Server Configuration
171
177
# =============================================================================
+5
-2
Caddyfile
+5
-2
Caddyfile
···
17
17
# provisioned as a fallback CA — without it Let's Encrypt is the ONLY
18
18
# issuer, and hitting LE's 50-new-certs-per-domain-per-week limit with
19
19
# on-demand handle certs would hard-fail new handshakes instead of
20
-
# falling back.
21
-
email brettmay0212@gmail.com
20
+
# falling back. {$ACME_EMAIL} is substituted from the caddy container's
21
+
# environment when the Caddyfile is parsed (set ACME_EMAIL in .env; a
22
+
# role address like support@<domain> — never a personal one, this file
23
+
# is public).
24
+
email {$ACME_EMAIL}
22
25
23
26
on_demand_tls {
24
27
ask http://tidepool:80/.well-known/tidepool-tls-ask
+4
docker-compose.prod.yml
+4
docker-compose.prod.yml
···
262
262
# Create at: Cloudflare Dashboard → My Profile → API Tokens → Create Token
263
263
# Permissions: Zone:DNS:Edit for coves.social zone
264
264
CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
265
+
# ACME account email, substituted into the Caddyfile's {$ACME_EMAIL}
266
+
# at parse time. Use a role address (e.g. support@coves.social) —
267
+
# the Caddyfile is committed to a public repo, the env file is not.
268
+
ACME_EMAIL: ${ACME_EMAIL:-}
265
269
volumes:
266
270
- ./Caddyfile:/etc/caddy/Caddyfile:ro
267
271
- caddy-data:/data