dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(caddy): expose Hermes webui and admin dashboard on internal-only vhosts

Browse Source 
Both Hermes services get direct (unguarded) vhosts: each authenticates itself
(webui password; dashboard basic_auth in /data/config.yaml), so no Anubis
challenge and no Authentik proxy provider is required. Upstreams are the host
LAN IP because Caddy itself sits on dankclaw_default, where the gateway
address 10.89.1.1 has nothing serving 8787. Internal-only by DNS absence:
hermes.franksdank.cloud already resolves via Pi-hole addn-hosts; hermesadmin
is added in this same commit so the caddyfile/addn-hosts cross-check (test 178)
stays green.
This commit is contained in:
Frank
2026-09-02 17:54:59 -07:00
parent 2e179b024d
commit 1e4daaa24a
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/Caddyfile
+23
View File
@@ -160,6 +160,29 @@ pihole.franksdank.cloud {
reverse_proxy 192.168.0.143:8083
}
# --- Hermes WebUI (Hermex webui; host-netns container, published 8787) ------
# Exempt by construction: the webui authenticates itself (HERMES_WEBUI_PASSWORD),
# so no Anubis challenge and no Authentik proxy provider is required — nothing
# here enters the http://:8016 auth chain. Internal-only by DNS absence: there is
# no public Porkbun A record for this name, so only LAN clients (Pi-hole
# addn-hosts → 192.168.0.143) can resolve it at all; DNS-01 issuance via the
# Porkbun module needs no public record. Upstream is the host LAN IP rather than
# localhost because Caddy itself lives on dankclaw_default: from that bridge the
# gateway address 10.89.1.1 has nothing serving 8787 (connection refused), while
# 192.168.0.143:8787 is open.
hermes.franksdank.cloud {
reverse_proxy 192.168.0.143:8787
}
# --- Hermes dashboard (admin UI; published 9119 on dankclaw_default) --------
# Exempt by construction: the app enforces its own complete auth — verified live
# from Caddy's own network, an unauthenticated GET / returns 302 → /login?next=%2F
# (uvicorn), and basic_auth.username + a scrypt password_hash are set in the
# dashboard's /data/config.yaml. No outpost provider needed.
hermesadmin.franksdank.cloud {
reverse_proxy 192.168.0.143:9119
}
# ═══════════════════════════════════════════════════════════════
# Services on dankserver (192.168.0.235) — published LAN ports
# ═══════════════════════════════════════════════════════════════
dankclaw/pihole/addn-hosts
+1
View File
@@ -38,6 +38,7 @@
192.168.0.143 comfyui.franksdank.cloud
192.168.0.143 ai.franksdank.cloud
192.168.0.143 hermes.franksdank.cloud
192.168.0.143 hermesadmin.franksdank.cloud
192.168.0.143 gitea.franksdank.cloud
192.168.0.143 grafana.franksdank.cloud
192.168.0.143 prometheus.franksdank.cloud