TP41: T4/T3/T2 durch (zt-svc, WARP-intern .36/.37, vw/admin 404 origin); Token-Altlast geklärt; TP42 angelegt

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-09-01 19:19:52 +02:00
parent faa4308223
commit 012397f194
4 changed files with 161 additions and 11 deletions
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -21,6 +21,13 @@
 # OEFFENTLICH  (via Cloudflare Tunnel + Access; Clients ohne WARP)
 # =========================================================================
 vw.emsenhuber.net {
+	# TP41 T2: /admin nur lokal/WARP-intern (kein CF-Header). Via CF (Header CF-Connecting-IP
+	# gesetzt) -> 404 statt Vault-Admin. Ersetzt die frühere WAF-Edge-Regel (403).
+	@cf_admin {
+		header CF-Connecting-IP *
+		path /admin /admin/*
+	}
+	respond @cf_admin 404
 	reverse_proxy http://10.40.20.127
 }