Frank
02883d3ed2
Copy of the legacy ~/.pi/agent/docs tree rebuilt as the command-center knowledge base: concept files promoted to path identity, index listings stripped of frontmatter, all wikilinks/relative links resolved, every checkable claim verified against the live fleet (Dankserver = Ryzen 7 7700X + RTX 3090; Strix Halo is Dankclaw), unverifiable claims tagged. kb-lint exits 0.
1.7 KiB
Caddy
Caddy is the reverse proxy and TLS terminator for the homelab. A single caddy
container on dankclaw (192.168.0.143) fronts every service on both hosts. It
runs Caddy v2.11.4 from the custom franksdank/caddy-porkbun image
(xcaddy-built with the Porkbun DNS-01 module, built locally on dankclaw).
Since 2026-08-26 it is managed as a Podman Quadlet unit (caddy.container)
installed to ~/.config/containers/systemd/, providing boot-persistent,
auto-restart service management.
- caddyfile — directive and matcher syntax, named matchers,
directive sorting, and the
handle/routeorder rule.
The Caddyfile lives in the serverAppConfigs repo at
dankclaw/Caddyfile. deploy.sh renders basicauth hashes from the host .env
(REPLACE_WITH_HASH → real bcrypt) into
/home/dank/Containers/caddy/Caddyfile, which the container mounts read-only;
Caddy's config file watcher (admin API, not disabled) hot-reloads on change.
The Caddyfile joins the dankclaw_default compose network so container-name
upstreams (authentik-server, grafana, etc.) still resolve.
TLS: Let's Encrypt wildcard certs via Porkbun DNS-01. The acme_dns block in
the Caddyfile reads API keys from /home/dank/Containers/caddy/env (deployed
from the repo's git-ignored .env). No inbound port 80/443 reachability is
needed from the internet — DNS-01 works entirely from the LAN, where Pi-hole
resolves *.franksdank.cloud names to dankclaw.
The porkbun DNS module source: caddy-dns/porkbun.
- Caddyfile Syntax — Caddy Caddyfile reference — directive and matcher syntax, named matchers, directive sorting, and the handle/route order rule. Grounded in caddyserver.com (fetched 2026-08-28).