From 1e4daaa24a241632f261b09787903ea2d56c1a69 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Wed, 2 Sep 2026 17:54:59 -0700
Subject: [PATCH] feat(caddy): expose Hermes webui and admin dashboard on
 internal-only vhosts

Both Hermes services get direct (unguarded) vhosts: each authenticates itself
(webui password; dashboard basic_auth in /data/config.yaml), so no Anubis
challenge and no Authentik proxy provider is required. Upstreams are the host
LAN IP because Caddy itself sits on dankclaw_default, where the gateway
address 10.89.1.1 has nothing serving 8787. Internal-only by DNS absence:
hermes.franksdank.cloud already resolves via Pi-hole addn-hosts; hermesadmin
is added in this same commit so the caddyfile/addn-hosts cross-check (test 178)
stays green.
---
 dankclaw/Caddyfile         | 23 +++++++++++++++++++++++
 dankclaw/pihole/addn-hosts |  1 +
 2 files changed, 24 insertions(+)

diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 4e2f4e2..fd69c0e 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -160,6 +160,29 @@ pihole.franksdank.cloud {
 	reverse_proxy 192.168.0.143:8083
 }
 
+# --- Hermes WebUI (Hermex webui; host-netns container, published 8787) ------
+# Exempt by construction: the webui authenticates itself (HERMES_WEBUI_PASSWORD),
+# so no Anubis challenge and no Authentik proxy provider is required — nothing
+# here enters the http://:8016 auth chain. Internal-only by DNS absence: there is
+# no public Porkbun A record for this name, so only LAN clients (Pi-hole
+# addn-hosts → 192.168.0.143) can resolve it at all; DNS-01 issuance via the
+# Porkbun module needs no public record. Upstream is the host LAN IP rather than
+# localhost because Caddy itself lives on dankclaw_default: from that bridge the
+# gateway address 10.89.1.1 has nothing serving 8787 (connection refused), while
+# 192.168.0.143:8787 is open.
+hermes.franksdank.cloud {
+	reverse_proxy 192.168.0.143:8787
+}
+
+# --- Hermes dashboard (admin UI; published 9119 on dankclaw_default) --------
+# Exempt by construction: the app enforces its own complete auth — verified live
+# from Caddy's own network, an unauthenticated GET / returns 302 → /login?next=%2F
+# (uvicorn), and basic_auth.username + a scrypt password_hash are set in the
+# dashboard's /data/config.yaml. No outpost provider needed.
+hermesadmin.franksdank.cloud {
+	reverse_proxy 192.168.0.143:9119
+}
+
 # ═══════════════════════════════════════════════════════════════
 # Services on dankserver (192.168.0.235) — published LAN ports
 # ═══════════════════════════════════════════════════════════════
diff --git a/dankclaw/pihole/addn-hosts b/dankclaw/pihole/addn-hosts
index 59753ea..191a751 100644
--- a/dankclaw/pihole/addn-hosts
+++ b/dankclaw/pihole/addn-hosts
@@ -38,6 +38,7 @@
 192.168.0.143 comfyui.franksdank.cloud
 192.168.0.143 ai.franksdank.cloud
 192.168.0.143 hermes.franksdank.cloud
+192.168.0.143 hermesadmin.franksdank.cloud
 192.168.0.143 gitea.franksdank.cloud
 192.168.0.143 grafana.franksdank.cloud
 192.168.0.143 prometheus.franksdank.cloud