landfall 0.4.2 → 0.4.4

package/README.md

@@ -121,6 +121,7 @@ with the newest release. An existing Docker is never reinstalled. In a terminal,
 | `--dashboard traefik.example.com` | Traefik dashboard behind basic auth (`traefik` alone means `traefik.<main domain>`) |
 | `--image traefik:v3.5` | Traefik image (remembered, default `traefik:v3`) |
 | `--host-network` | run Traefik on the host network (remembered), see [Traefik](#traefik) |
+| `--no-http3` | Traefik without HTTP/3 on 443/udp (remembered), see [Traefik](#traefik) |
 | `--no-firewall` / `--no-harden` / `--no-traefik` / `--no-ssh-config` | skip a step |
 | `--check` / `--key-only` / `--force` | report only / install only the key / apply despite conflicts |
 
@@ -135,7 +136,7 @@ No domain yet? Leave out `-d`. landfall offers `<name>.<ip-with-dashes>.sslip.io
 | kind | when | how |
 |---|---|---|
 | **compose** | the folder has a `compose.yaml` | Uploads the folder and runs it as one Compose project. See [Compose sites](#compose-sites). |
-| **static** | no compose file, no Dockerfile | Uploads the folder and serves it with `nginx:alpine` (gzip, long cache headers for assets). The folder is `.` if it has an `index.html`, else the first of `dist/ build/ out/ public/ _site/ site/`. `--spa` sends unknown paths to `index.html`. |
+| **static** | no compose file, no Dockerfile | Uploads the folder and serves it with `nginx:alpine` (gzip, long cache headers for assets). The folder is where the site generator builds to, even before the first build (Vite/Astro `dist/` or its `outDir`, SvelteKit/CRA/Docusaurus `build/`, Next `out/`, Gatsby/Hugo `public/`, Eleventy/Jekyll `_site/`, Nuxt `.output/public/`, Angular, MkDocs `site/`), else `.` if it has an `index.html`, else the first of `dist/ build/ out/ public/ _site/ site/` with one. `lf deploy <dir>` picks another. `--spa` sends unknown paths to `index.html`. |
 | **dockerfile** | the folder has a `Dockerfile` | Uploads the folder and builds it on the server. The port comes from `EXPOSE`, else `--port` (default 3000). `--static` forces static. |
 | **image** | `--image ghcr.io/me/app:1.2` | Pulls the image and runs it. Needs `--port`. For private registries: `lf ssh vps -- docker login ghcr.io`. |
 
@@ -260,8 +261,11 @@ lf domains                         # where DNS points, whether HTTPS answers
 lf domains --add www.example.com   # also --rm, --set (updates .landfall.json)
 lf domains --rm @                  # take the main domain off; the last one leaves the site running, unrouted
 lf auth -u anna                    # login in front of the site (asks for the password, -p passes it)
+lf auth -p '…'                     # the same for user admin
 lf auth --rm-user anna | --off
 lf open
+lf tunnel blog                     # http://localhost:<port> straight to its container: test it without a domain
+lf tunnel my-compose-app -s het    # also any Compose project or container landfall did not deploy
 lf sites rm blog                   # delete the site (asks you to type the name)
 lf logs api -s vps                 # another site on another server
 ```
@@ -292,8 +296,10 @@ Version-pinned tags show the newest tag of the same shape (`traefik:v3.6` → `t
 lf traefik status                              # container state, routes, mode
 lf traefik logs -f                             # certificate errors show up here
 lf traefik setup --email you@example.com       # reconfigure (safe to re-run)
-lf traefik setup --dashboard traefik           # dashboard at traefik.<main domain>; `off` removes it
+lf traefik setup --dashboard traefik           # dashboard at traefik.<main domain> behind a login; `off` removes it
+lf traefik dashboard                           # the dashboard on localhost through an SSH tunnel, no domain needed
 lf traefik setup --host-network                # bind 80/443 on the host
+lf traefik setup --no-http3                    # turn HTTP/3 off (on by default)
 ```
 
 landfall's Traefik is the container `traefik` from `/opt/landfall/traefik/docker-compose.yml`. By default Docker
@@ -304,6 +310,11 @@ publishes 80/443 to it. Sites work the same in both modes:
 | client IP in logs / `X-Forwarded-For` | real IPv4; IPv6 may show Docker's gateway | always real |
 | ufw | Docker's NAT bypasses ufw for 80/443 | ufw applies |
 
+HTTP/3 (QUIC) is on by default: Traefik also listens on 443/udp, and browsers switch to it after their first
+HTTP/2 request. Setup's firewall opens 443/udp; with `--host-network` on a server whose ufw is already active,
+`lf traefik setup` adds the rule. `--no-http3` turns it off (remembered). In the web UI (`lf ui`)
+these options are in a server's settings under Traefik → Settings….
+
 Traefik only answers hosts it has a certificate for (`sniStrict`). A domain pointed at the server but served
 by no site fails the TLS handshake, as if nothing listened there, instead of showing a 404 or Traefik's own
 certificate; plain HTTP to it redirects to HTTPS and fails the same way. A new site's domain fails the same way
@@ -311,7 +322,10 @@ for the seconds until Let's Encrypt issues its certificate. Your own certificate
 `/opt/landfall/traefik/dynamic/`: landfall rewrites only `landfall.yml` there. If you edit
 `docker-compose.yml` by hand, `lf traefik setup` shows the diff and stops; `--force` overwrites your edits.
 
-The dashboard password is generated and printed once (`--dashboard-password` sets your own). Image, network mode,
+The dashboard password is generated and printed once (`--dashboard-password` sets your own, `--dashboard-user` the user, default `admin`).
+The dashboard is always reachable through `lf traefik dashboard`: Traefik serves it on port 8080 to the server itself only
+(loopback and the `web` network's gateway), never published. A Traefik set up before this needs `lf traefik setup` once.
+With your own Traefik, `lf traefik dashboard` tunnels to the entrypoint of the router that serves the dashboard on a domain and sends that domain along (TLS name and Host), so its login still applies; without such a router, `--port 8080` tunnels to its API port (api.insecure). The web UI shows the domains its dashboard is on. Image, network mode,
 e-mail, staging and dashboard are remembered per server.
 
 **Using a Traefik you already run.** If 80/443 belong to your own Traefik container, landfall does not install a second one:
@@ -469,7 +483,7 @@ lf undo -s box -y                           # revert the last run
 
 | command | what it does |
 |---|---|
-| `lf traefik setup [--email e] [--dashboard host\|traefik\|off] [--staging] [--image img] [--host-network] [--force]` | Installs or reconfigures landfall's Traefik. `--force` overwrites hand edits. |
+| `lf traefik setup [--email e] [--dashboard host\|traefik\|off] [--staging] [--image img] [--host-network] [--no-http3] [--force]` | Installs or reconfigures landfall's Traefik. `--force` overwrites hand edits. |
 | `lf traefik use [container] [--network n --entrypoint e --resolver r]` | Routes sites through a Traefik you already run. |
 | `lf traefik rm [--certs]` | Removes landfall's Traefik (undoable), or stops using yours after `traefik use`. |
 | `lf traefik status` / `logs [-f]` / `restart` | Inspects or restarts Traefik. `lf traefik` alone means `status`. |