Fix/20260813 1

client/resource_image_test.go

@@ -515,6 +515,10 @@ func TestImageLockStore_SameAliasSerializes(t *testing.T) {
 	release, err := a.lockStore(ctx)
 	require.NoError(t, err)
 
+	// The t.Fatal below returns without reaching the release further down.
+	release = sync.OnceFunc(release)
+	defer release()
+
 	acquired := make(chan error, 1)
 	go func() {
 		releaseB, err := b.lockStore(ctx)

examples/README.md

@@ -1,14 +1,13 @@
 # Examples
 
-- [caddy](https://docs.incus-compose.org/examples/caddy) — Caddy as a reverse-proxy front door — automatic HTTPS, one `Caddyfile`, no separate cert management.
-- [dns](https://docs.incus-compose.org/examples/dns/) — A split-horizon home resolver: `dnscrypt-proxy` as the client-facing resolver, `knot` as the authoritative server for the local `example.com` zone.
+- [caddy](https://docs.incus-compose.org/examples/caddy) — Caddy as a reverse-proxy front door, split in two — a host-facing instance and an internal one, sharing one certificate store.
 - [gitea](https://docs.incus-compose.org/examples/gitea/) — Gitea, a lightweight self-hosted Git service, backed by Postgres.
 - [hugo](https://docs.incus-compose.org/examples/hugo/) — Hugo is one of the most popular open-source static site generators — fast builds, no runtime dependencies.
 - [immich](https://docs.incus-compose.org/examples/immich/) — Immich, a self-hosted photo and video backup solution.
 - [kimai](https://docs.incus-compose.org/examples/kimai/) — Kimai, an open-source time-tracking application, backed by MariaDB.
 - [leafwiki](https://docs.incus-compose.org/examples/leafwiki/) — LeafWiki — a self-hosted wiki as a single Go binary, Markdown + SQLite on disk, no external database.
 - [many-dependencies](many-dependencies/) — Testbed and example for a deep service dependency graph, exercising `depends_on` with `condition: service_healthy`.
 - [oci-registry-cache](https://docs.incus-compose.org/examples/oci-registry-cache/) — Runs distribution registry instances as pull-through caches, one per upstream registry, so container images are fetched once and served locally on subsequent pulls.
-- [pdns-dnsweaver](https://docs.incus-compose.org/examples/pdns-dnsweaver/) — Combines powerDNS, powerdns-admin, dnsweaver and dnscrypt-proxy.
+- [pdns](https://docs.incus-compose.org/examples/pdns/) — A split-horizon home resolver: `dnscrypt-proxy` as the client-facing resolver, PowerDNS as the authoritative server for the local zone, with PowerDNS-Admin and MariaDB behind it.
 - [raw-bind-mount](raw-bind-mount/) — Bind-mounting an arbitrary host path into an Incus container via `x-incus.raw.lxc`, for when a regular Compose `volumes:` bind mount isn't expressive enough.
 - [wikijs](https://docs.incus-compose.org/examples/wikijs/) — Wiki.js, a modern wiki app, backed by Postgres.

examples/caddy/.env

@@ -1,4 +1,9 @@
 # Static IP
 export EXTERNAL_NETWORK="incusbr0"
-export IPV4_GATEWAY="10.179.215.1"
-export IPV4_CADDY="10.179.215.4/24"
+
+export NET_EXTERNAL="true"
+export NET_NAME="incusbr0"
+export IPV4_GATEWAY="10.1.2.1"
+export IPV4_NETMASK="23"
+export IPV4_CADDY_EXTERNAL="10.1.2.3"
+export IPV4_CADDY_INTERNAL="10.1.2.4"

examples/caddy/compose.incus.yaml

@@ -1,13 +1,19 @@
 services:
-  caddy:
+  external:
     networks:
       default:
+        ipv4_address: "${IPV4_CADDY_EXTERNAL}/${IPV4_NETMASK}"
         x-incus:
-          ipv4.address: ${IPV4_CADDY}
-          ipv4.gateway: ${IPV4_GATEWAY}
+          ipv4.gateway: "${IPV4_GATEWAY}"
+
+  internal:
+    networks:
+      default:
+        ipv4_address: "${IPV4_CADDY_INTERNAL}/${IPV4_NETMASK}"
+        x-incus:
+          ipv4.gateway: "${IPV4_GATEWAY}"
 
 networks:
   default:
-    external: true
-    x-incus-compose:
-      network: ${EXTERNAL_NETWORK}
+    external: ${NET_EXTERNAL}
+    name: "${NET_NAME}"

examples/caddy/compose.yaml

@@ -1,11 +1,37 @@
 services:
-  caddy:
+  external:
+    # https://hub.docker.com/_/caddy/
     image: docker.io/library/caddy:2.11.4-alpine
-    command: /bin/sh -c "/bin/sleep 5; caddy run --config /etc/caddy/Caddyfile --adapter caddyfile"
+    container_name: external_caddy
+    entrypoint: /bin/sh -c "sleep 3; caddy run --config /etc/caddy/Caddyfile --adapter caddyfile"
     volumes:
-      - ./caddy:/etc/caddy:ro
+      - ./external:/etc/caddy:ro
       - ./sites:/var/www:ro
       - data:/data/caddy
+    networks:
+      default:
+    restart: unless-stopped
+    ports:
+      - published: 80
+        target: 80
+      #        x-incus-compose:
+      #          nat: true
+      - published: 443
+        target: 443
+  #        x-incus-compose:
+  #          nat: true
+
+  internal:
+    image: docker.io/library/caddy:2.11.4-alpine
+    container_name: internal_caddy
+    entrypoint: /bin/sh -c "sleep 3; caddy run --config /etc/caddy/Caddyfile --adapter caddyfile"
+    volumes:
+      - ./internal:/etc/caddy:ro
+      - ./sites:/var/www:ro
+      - data:/data/caddy
+    networks:
+      default:
+    restart: unless-stopped
 
 volumes:
   data:

examples/caddy/external/Caddyfile

@@ -0,0 +1,45 @@
+{
+  storage file_system /data/caddy
+}
+
+www.example.com {
+	redir https://example.com
+}
+
+docker-registry.example.com {
+  redir https://example.com
+}
+
+ghcr-registry.example.com {
+  redir https://example.com
+}
+
+gitlab-registry.example.com {
+  redir https://example.com
+}
+
+clock.example.com {
+  redir https://example.com
+}
+
+git.example.com {
+	log {
+		output file /var/log/caddy/git.example.com-access.log
+	}
+
+	reverse_proxy 10.136.32.17:3000
+}
+
+example.com {
+	log {
+		output file /var/log/caddy/example.com-access.log
+	}
+
+	root * /var/www/example.com
+	encode
+	handle_errors {
+		rewrite * /
+		file_server
+	}
+	file_server
+}

examples/caddy/internal/Caddyfile

@@ -0,0 +1,66 @@
+{
+        storage file_system /data/caddy
+        auto_https disable_certs
+}
+
+www.example.com {
+	redir https://example.com
+}
+
+docker-registry.example.com {
+  tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/docker-registry.example.com/docker-registry.example.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/docker-registry.example.com/docker-registry.example.com.key
+  log {
+    output file /var/log/caddy/docker-registry.example.com-access.log
+  }
+
+  reverse_proxy 10.132.32.17:5000
+}
+
+ghcr-registry.example.com {
+  tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/ghcr-registry.example.com/ghcr-registry.example.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/ghcr-registry.example.com/ghcr-registry.example.com.key
+  log {
+    output file /var/log/caddy/ghcr-registry.example.com-access.log
+  }
+
+  reverse_proxy 10.132.32.18:5000
+}
+
+gitlab-registry.example.com {
+  tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/gitlab-registry.example.com/gitlab-registry.example.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/gitlab-registry.example.com/gitlab-registry.example.com.key
+  log {
+    output file /var/log/caddy/gitlab-registry.example.com-access.log
+  }
+
+  reverse_proxy 10.132.32.19:5000
+}
+
+clock.example.com {
+  tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/clock.example.com/clock.example.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/clock.example.com/clock.example.com.key
+	log {
+		output file /var/log/caddy/time.example.com-access.log
+	}
+
+	reverse_proxy 10.137.32.17:8001
+}
+
+git.example.com {
+	log {
+		output file /var/log/caddy/git.example.com-access.log
+	}
+
+	reverse_proxy 10.136.32.17:3000
+}
+
+example.com {
+	log {
+		output file /var/log/caddy/example.com-access.log
+	}
+
+	root * /var/www/example.com
+	encode
+	handle_errors {
+		rewrite * /
+		file_server
+	}
+	file_server
+}