Auto-PR: feat(anythingllm): cloudflare_proxied mode — Origin CA cert instead of ACME

[weown-bot]

🤖 Automated Pull Request — authored by weown-bot (ecosystem service account)

Opened by: @ncimino
Last pushed by: @ncimino
Branch: feature/nik-cloudflare-origin → main

Contributors on this branch:

• @ncimino (1 commit)

---

📋 Human Review Checklist — NIST CSF 2.0 Functions

Review per the 6 NIST CSF Functions. Frameworks referenced: NIST CSF 2.0, CIS Controls v8 IG1, CSA CCM v4, ISO/IEC 27001:2022, SOC 2, ISO/IEC 42001:2023. See docs/COMPLIANCE_ROADMAP.md.

🏛️ Govern (GV)

• CODEOWNERS correct for affected paths (.github/CODEOWNERS)
• ADR required/updated if an architectural decision is introduced
• Policy impact considered and documented
• All Copilot AI review comments addressed or explicitly deferred with rationale

🔍 Identify (ID)

• New assets inventoried (Helm values, container images, dependencies)
• SBOM regenerated if dependencies changed
• Risk register / threat model touched if threat surface changed (.github/SECURITY_ASSESSMENT.md)

🛡️ Protect (PR)

• Least privilege: RBAC, ServiceAccounts, scoped PATs (NIST PR.AC, CIS 5/6, ISO A.5.15-A.5.18)
• Secrets managed via Infisical (never --from-literal, never /tmp, always $(mktemp) — ISO A.8.24)
• NetworkPolicy present for new deployments (NIST PR.AC-5, CIS 12, CSA IVS)
• TLS 1.3 with strong cipher suites where applicable (NIST PR.DS-1, CIS 3)
• Container security: non-root UID 1000+, Pod Security restricted (NIST PR.IP, CIS 4)

🕵️ Detect (DE)

• Logs / metrics added for new components (NIST DE.CM, CIS 8/13)
• Alert rules updated if thresholds change
• Health checks (livenessProbe + readinessProbe) configured

🚨 Respond (RS)

• Runbook updated if operational behavior changes (.github/INCIDENT_RESPONSE.md)
• Incident response impact considered (escalation paths, on-call)

♻️ Recover (RC)

• Backup strategy covers new persistent data (NIST RC.RP, CIS 11, ISO A.8.13)
• Rollback procedure tested or documented
• DR impact assessed for new critical components

📚 Documentation & Versioning

• Relevant CHANGELOG.md updated (per-directory or repo-level /CHANGELOG.md)
• #WeOwnVer version bumped per docs/VERSIONING_WEOWNVER.md
• READMEs / ADRs / inline comments updated

---

📝 Recent Commits (full bodies for Copilot context)

9349b58 feat(anythingllm): cloudflare_proxied mode — Origin CA cert instead of ACME

Author: Nik
Date: Thu Jul 23 16:53:07 2026 -0600

The per-brand .weown.chat hosting model (Jason 2026-07-21) puts tenants
behind Cloudflare Pro's proxy, where ACME HTTP-01 cannot complete — exactly the
525 f1visa.weown.chat throws today. New copier bool cloudflare_proxied
(default false; existing direct-DNS sites render identically): Caddy serves the
Cloudflare Origin CA certificate, with the PEMs arriving as CF_ORIGIN_CERT /
CF_ORIGIN_KEY through the same ADR-006 Infisical entrypoint wrapper as every
other secret and materialised as 0600 files inside the container at start —
never on host disk, re-fetched on every restart.

Origin-CA over DNS-01 was deliberate: no custom Caddy build, and no DNS-edit
API token sitting on customer droplets. One wildcard cert covers *.weown.chat;
it lives at the initiative-project ROOT (operator-readable only — droplet MIs
are path-scoped and cannot read it), and weown-fleet provisioning copies it
into each proxied tenant's folder.

Verification: copier renders clean in both modes and the rendered compose
parses; the cert-materialise command proven against a multi-line PEM in env
(content intact, 0600); registry flag -> render/provision wiring in weown-fleet.

---

---

🔍 Copilot AI Review: Copilot is configured to auto-request review for bot-authored PRs. If an auto-created PR opens without an initial Copilot review, push a follow-up commit to the same open PR (review_on_push: true) to trigger review automatically.

👥 Required Reviewers: human approval enforced by branch protection + CODEOWNERS. @ncimino requested automatically.

📚 Review Guidelines: .github/copilot-instructions.md (phase-aware compliance directives)

🛠️ Workflow Operations: .github/workflows/README.md

Auto-generated by .github/workflows/auto-pr-to-main.yml

[Copilot]

Pull request overview

Adds an optional cloudflare_proxied deployment mode for the anythingllm-docker/ copier template so Caddy serves a Cloudflare Origin CA certificate (instead of ACME HTTP-01) when a tenant domain is behind Cloudflare’s proxy.

Changes:

• Introduces a new copier boolean cloudflare_proxied (default false) to toggle Cloudflare-proxied behavior.
• When enabled, updates the Caddy container to use the Infisical entrypoint wrapper and materialize CF_ORIGIN_CERT / CF_ORIGIN_KEY into /certs/* before starting Caddy.
• Adds conditional tls /certs/origin.crt /certs/origin.key in the Caddyfile for proxied domains and documents the feature in the root CHANGELOG.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
CHANGELOG.md	Documents the new cloudflare_proxied mode for anythingllm-docker.
anythingllm-docker/template/docker/compose.prod.yaml.jinja	Conditionally injects Infisical wrapper + cert/key materialization for Caddy when cloudflare_proxied is enabled.
anythingllm-docker/template/docker/Caddyfile.jinja	Conditionally configures Caddy to use Cloudflare Origin CA TLS assets.
anythingllm-docker/copier.yaml	Adds the cloudflare_proxied copier variable and its help text.