Frank
c99eb8e11b
Live read-only probes on Dankclaw (BatchMode ssh, 2026-10-19):
- system/dankclaw.md: full 32-container census added (authentik IdP,
prometheus/grafana/loki/alloy/alertmanager monitoring, pihole, ntfy,
seerr, hermes stack, anubis, frank-tts :7772 all undocumented);
dragoon pool corrected 401,408 @ ctx 200,704 (was conflated);
zealot corrected to PrismML build 10777, Ternary-Bonsai-2-9B
PQ2_0-MTP, 2x262,144 over one 524,288 pool, f16 K+V (doc claimed
build 10754, 27B, 2x200,704)
- caddy/index.md: v2.11.7 (in-container ), deduped
caddyfile listing
- gitea: version 1.27.3 probed via API; systemd-gitea network + rootless
100999 mapping confirmed live (gitea-server attaches systemd-gitea;
dank subuid 100000:65536); index See-Also de-duplicated
- searxng-tuning.md: live instance section (ghcr image, valkey:9-alpine,
marreta netns-sharing explains duplicate port maps); POLICY DRIFT FLAG:
tuned engine policy (google/bing disabled, verified 2026-08-16) is NOT
live — /config now shows all 262 engines enabled; upstream settings.yml
count corrected 388@master; limiter table already matched source
- vpn-routing.md: verify snippet fixed — gluetun image ships no curl;
health server is 127.0.0.1:9999/health ('OK'), :8000 is the CONTROL
server (404s on health paths); correct probes provided
Refs #29
30 lines
1.6 KiB
Markdown
30 lines
1.6 KiB
Markdown
# Caddy
|
|
|
|
Caddy is the reverse proxy and TLS terminator for the homelab. A single caddy
|
|
container on dankclaw (192.168.0.143) fronts every service on both hosts. It
|
|
runs Caddy v2.11.7 (verified in-container 2026-10-19) from the custom
|
|
`localhost/franksdank/caddy-porkbun:latest` image (xcaddy-built with the
|
|
Porkbun DNS-01 module, built locally on dankclaw).
|
|
Since 2026-08-26 it is managed as a Podman Quadlet unit (`caddy.container`)
|
|
installed to `~/.config/containers/systemd/`, providing boot-persistent,
|
|
auto-restart service management.
|
|
|
|
|
|
The Caddyfile lives in the serverAppConfigs repo at
|
|
`dankclaw/Caddyfile`. `deploy.sh` renders basicauth hashes from the host `.env`
|
|
(`REPLACE_WITH_HASH` → real bcrypt) into
|
|
`/home/dank/Containers/caddy/Caddyfile`, which the container mounts read-only;
|
|
Caddy's config file watcher (admin API, not disabled) hot-reloads on change.
|
|
The Caddyfile joins the `dankclaw_default` compose network so container-name
|
|
upstreams (authentik-server, grafana, etc.) still resolve.
|
|
|
|
TLS: Let's Encrypt wildcard certs via Porkbun DNS-01. The `acme_dns` block in
|
|
the Caddyfile reads API keys from `/home/dank/Containers/caddy/env` (deployed
|
|
from the repo's git-ignored `.env`). No inbound port 80/443 reachability is
|
|
needed from the internet — DNS-01 works entirely from the LAN, where Pi-hole
|
|
resolves `*.franksdank.cloud` names to dankclaw.
|
|
|
|
The porkbun DNS module source: [caddy-dns/porkbun](https://github.com/caddy-dns/porkbun).
|
|
|
|
* [Caddyfile Syntax](caddyfile.md) — Caddy Caddyfile reference — directive and matcher syntax, named matchers, directive sorting, and the `handle`/`route` order rule. Grounded in caddyserver.com (fetched 2026-08-28).
|