sudo add-apt-repository ppa:longsleep/golang-backports
sudo apt update # 我觉得是多余的
sudo apt install golang-go

sudo apt install software-properties-common

export GO111MODULE=on
go env -w GOPROXY=https://goproxy.cn,direct

mkdir caddy
cd caddy
nano caddy.go # 见下方 caddy.go 内容

go mod init
go build # 之后当前目录下会有一个 caddy 文件

package main

import (
        "github.com/caddyserver/caddy/caddy/caddymain"

        // plug in plugins here, for example:
        // _ "import/path/here"
        _ "github.com/colachg/caddy-alidns"

        // hook.service 插件不是必要的
        _ "github.com/hacdias/caddy-service"

        // 下面这个插件似乎有点问题，build 不过去，所以取消掉了
        // _ "github.com/pieterlouw/caddy-net/caddynet"

        _ "github.com/captncraig/caddy-realip"
        _ "github.com/abiosoft/caddy-git"
        _ "github.com/epicagency/caddy-expires"
        _ "github.com/caddyserver/dnsproviders/cloudflare"
)

func main() {
        // optional: disable telemetry
        // caddymain.EnableTelemetry = false
        caddymain.Run()
}

# 复制 caddy 文件到 /usr/local/bin + 处理权限
sudo cp caddy /usr/local/bin
sudo chown root:root /usr/local/bin/caddy
sudo chmod 755 /usr/local/bin/caddy

# 让非 root 权限下的 caddy 也可以监听 80, 443
sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/caddy

# www-data 用户
sudo groupadd -g 33 www-data
sudo useradd \
  -g www-data --no-user-group \
  --home-dir /var/www --no-create-home \
  --shell /usr/sbin/nologin \
  --system --uid 33 www-data

# 在 /etc 下存放配置与 SSL 证书
sudo mkdir /etc/caddy
sudo chown -R root:root /etc/caddy
sudo mkdir /etc/ssl/caddy
sudo chown -R root:www-data /etc/ssl/caddy
sudo chmod 0770 /etc/ssl/caddy

# Caddyfile
sudo touch /etc/caddy/Caddyfile
sudo chown root:root /etc/caddy/Caddyfile
sudo chmod 644 /etc/caddy/Caddyfile

# /var/www 存放网页
sudo mkdir /var/www
sudo chown www-data:www-data /var/www
sudo chmod 555 /var/www

# systemd service unit
wget https://raw.githubusercontent.com/caddyserver/caddy/master/dist/init/linux-systemd/caddy.service # 可能下载不下来，这时得手动新建一下，文件内容见后
sudo cp caddy.service /etc/systemd/system/
sudo chown root:root /etc/systemd/system/caddy.service
sudo chmod 644 /etc/systemd/system/caddy.service
sudo systemctl daemon-reload
sudo systemctl start caddy.service

# 开机自启
sudo systemctl enable caddy.service

[Unit]
Description=Caddy HTTP/2 web server
Documentation=https://caddyserver.com/docs
After=network-online.target
Wants=network-online.target systemd-networkd-wait-online.service

; Do not allow the process to be restarted in a tight loop. If the
; process fails to start, something critical needs to be fixed.
StartLimitIntervalSec=14400
StartLimitBurst=10

[Service]
Restart=on-abnormal

; User and group the process will run as.
User=www-data
Group=www-data

; Letsencrypt-issued certificates will be written to this directory.
Environment=CADDYPATH=/etc/ssl/caddy

; Always set "-root" to something safe in case it gets forgotten in the Caddyfile.
ExecStart=/usr/local/bin/caddy -log stdout -log-timestamps=false -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp
ExecReload=/bin/kill -USR1 $MAINPID

; Use graceful shutdown with a reasonable timeout
KillMode=mixed
KillSignal=SIGQUIT
TimeoutStopSec=5s

; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
LimitNOFILE=1048576
; Unmodified caddy is not expected to use more than that.
LimitNPROC=512

; Use private /tmp and /var/tmp, which are discarded after caddy stops.
PrivateTmp=true
; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.)
PrivateDevices=false
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
ProtectHome=true
; Make /usr, /boot, /etc and possibly some more folders read-only.
ProtectSystem=full
; … except /etc/ssl/caddy, because we want Letsencrypt-certificates there.
;   This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
ReadWritePaths=/etc/ssl/caddy
ReadWriteDirectories=/etc/ssl/caddy

; The following additional security directives only work with systemd v229 or later.
; They further restrict privileges that can be gained by caddy. Uncomment if you like.
; Note that you may have to add capabilities required by any plugins in use.
;CapabilityBoundingSet=CAP_NET_BIND_SERVICE
;AmbientCapabilities=CAP_NET_BIND_SERVICE
;NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

baseURL = "https://rwong.tech/"
languageCode = "zh-CN"
title = "蛙声一片"
theme = "even"

[permalinks]
  posts = "/:year/:month/:title/"

(alitls) {
  tls {
    dns alidns
  }
}

rwong.tech {
  import alitls
  root /var/www/rwong-tech-blog/public
  git {
    repo https://github.com/robinWongM/rwong-tech-blog.git
    path ../
    branch master
    interval -1
    hook /github/webhook **secret**
    then hugo --destination=/var/www/rwong-tech-blog/public
  }
}

ddns.rwong.tech {
  import alitls
}