From e99b6e1c28a71932951c2f4bcaf4b1a80bc445ab Mon Sep 17 00:00:00 2001 From: mikl Date: Sun, 12 Jul 2026 18:19:22 +0300 Subject: [PATCH] heather: fix syncthing host-check error behind Caddy reverse proxy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Syncthing отдаёт 403 'Host check error' когда Host header не совпадает с адресом прослушивания (127.0.0.1:8384) — это DNS rebinding protection. Caddy подменяет Host на бэкенде через header_up Host 127.0.0.1:8384. --- hosts/heather/caddy.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hosts/heather/caddy.nix b/hosts/heather/caddy.nix index 9446722..86925a6 100644 --- a/hosts/heather/caddy.nix +++ b/hosts/heather/caddy.nix @@ -35,8 +35,14 @@ in { virtualHosts = { # --- Syncthing GUI (host-сервис) --- + # header_up Host 127.0.0.1:8384 — обходим syncthing host-check (DNS + # rebinding protection): syncthing сравнивает Host header с адресом + # прослушивания (127.0.0.1:8384) и отдаёт 403 "Host check error" для + # внешних доменов. Подменяем Host на бэкенде. "sync.iscg.dev".extraConfig = syncBasicAuth + '' - reverse_proxy 127.0.0.1:8384 + reverse_proxy 127.0.0.1:8384 { + header_up Host 127.0.0.1:8384 + } ''; # --- Контейнеры (arion, см. arion-compose.nix) ---