Caddy consolidation: single Caddy on dankclaw fronts both hosts
Per user direction, Caddy runs only on dankclaw. It fronts every service on both hosts: local services by container name, quadlet services by published LAN port, dankserver services by published LAN port (192.168.0.235:PORT). - dankclaw/Caddyfile: merged vhost list (was: two Caddyfiles, one per host). gitea's single vhost moves in from the retired gitea-caddy quadlet (option B). Upstreams fixed to live reality: gitea :3000, search :8081 (gluetun), chat :3005 (open-webui quadlet), media services via 192.168.0.235. Retired: llms (open-webui on dankserver is removed; chat is its successor), the dankserver homepage (302 to the shared one). - dankserver/Caddyfile, dankclaw/gitea/Caddyfile: deleted (git rm). - dnsmasq addn-hosts: every name -> 192.168.0.143 (the one Caddy host); no .235 records, no llms. - compose.yaml: removed the openwebui/postgres/gitea services (they are quadlets now); caddy service mounts the rendered Caddyfile from /home/dank/Containers/caddy, healthcheck probes the bare-IP catch-all (302). - deploy.sh: per-target logic (dankserver = pull-only, health via the shared Caddy at 192.168.0.143); renders CADDY_BASICAUTH_HASH from the host .env into the mounted Caddyfile. - .env.example: CADDY_BASICAUTH_HASH on dankclaw; Porkbun block dropped from dankserver (its Caddy is gone); SEARXNG_BASE_URL to the flat name; stale OPENAI_* block dropped (quadlet is self-contained). - tests: caddyfile.bats now asserts the single-Caddyfile invariant; dnsmasq.bats cross-checks vhosts -> .143 and the retired names.
This commit is contained in:
Frank committed
1 parent
9c8298df05
commit
4a679fce80
10 files changed
+236
-277
No files matched your search
+104
-15
@@ -1,12 +1,19 @@
|
||||
# Dankclaw Caddyfile
|
||||
# Reverse proxy for the Dankclaw stack. Caddy runs as a container on the
|
||||
# podman network; upstreams are container names. Homepage is password
|
||||
# protected. Replace the bcrypt hashes below (caddy hash-password) at deploy.
|
||||
# Homelab Caddyfile — the single Caddy for both hosts.
|
||||
#
|
||||
# Naming: flat franksdank.cloud scheme (see docs/Infrastructure/Domain-DNS.md).
|
||||
# Caddy runs as a container on dankclaw (192.168.0.143, this repo's
|
||||
# compose.yaml service 'caddy') and fronts every service on both hosts:
|
||||
# - dankclaw services: by container name (compose network) or by the
|
||||
# published LAN port (quadlet services on isolated networks)
|
||||
# - dankserver services (192.168.0.235): by published LAN port
|
||||
#
|
||||
# Naming: flat franksdank.cloud scheme (see docs/Infrastructure/LAN-DNS.md).
|
||||
# DNS for these names is served by the dnsmasq quadlet on this host
|
||||
# (dankclaw/dnsmasq/addn-hosts) and handed to LAN clients by the SURFboard
|
||||
# G36 router (DNS Relay -> statically configured -> 192.168.0.143).
|
||||
# (dankclaw/dnsmasq/addn-hosts — every name resolves to 192.168.0.143)
|
||||
# and handed to LAN clients by the SURFboard G36 router.
|
||||
#
|
||||
# The basicauth hash below is a placeholder. deploy.sh renders the real
|
||||
# hash (CADDY_BASICAUTH_HASH from the host .env, git-ignored) into
|
||||
# /home/dank/Containers/caddy/Caddyfile, which the container mounts.
|
||||
#
|
||||
# Phase 1 uses explicit http:// site addresses (no TLS yet). Phase 2 drops
|
||||
# the prefix and adds a wildcard Let's Encrypt cert via DNS-01 (Porkbun).
|
||||
@@ -30,12 +37,21 @@ http://dankclaw.franksdank.cloud {
|
||||
file_server
|
||||
}
|
||||
|
||||
# --- SearXNG (behind the Gluetun tunnel) ---
|
||||
# --- Legacy name: the media host has no Caddy of its own anymore ---
|
||||
http://dankserver.franksdank.cloud {
|
||||
redir http://dankclaw.franksdank.cloud/ 302
|
||||
}
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
# Services on this host (dankclaw, 192.168.0.143)
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
|
||||
# --- SearXNG (quadlet; behind the Gluetun tunnel, published 8081) ---
|
||||
http://search.franksdank.cloud {
|
||||
basicauth {
|
||||
dank $2a$14$REPLACE_WITH_HASH
|
||||
}
|
||||
reverse_proxy gluetun:8080
|
||||
reverse_proxy 192.168.0.143:8081
|
||||
}
|
||||
|
||||
# --- ComfyUI ---
|
||||
@@ -43,9 +59,7 @@ http://comfyui.franksdank.cloud {
|
||||
reverse_proxy comfyui:8188
|
||||
}
|
||||
|
||||
# --- OpenWebUI ---
|
||||
# open-webui is a quadlet container on slirp4netns (isolated), so Caddy cannot
|
||||
# reach it by container name. Proxy to its published LAN port instead.
|
||||
# --- OpenWebUI (quadlet on slirp4netns; published 3005) ---
|
||||
http://chat.franksdank.cloud {
|
||||
basicauth {
|
||||
dank $2a$14$REPLACE_WITH_HASH
|
||||
@@ -61,9 +75,9 @@ http://hermes.franksdank.cloud {
|
||||
reverse_proxy hermes:8090
|
||||
}
|
||||
|
||||
# --- Gitea (migrated) ---
|
||||
# --- Gitea (quadlet; published 3000) ---
|
||||
http://gitea.franksdank.cloud {
|
||||
reverse_proxy gitea-server:3000
|
||||
reverse_proxy 192.168.0.143:3000
|
||||
}
|
||||
|
||||
# --- Grafana ---
|
||||
@@ -84,8 +98,83 @@ http://prometheus.franksdank.cloud {
|
||||
|
||||
# --- Loki ---
|
||||
http://loki.franksdank.cloud {
|
||||
reverse_proxy loki:3100
|
||||
}
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
# Services on dankserver (192.168.0.235) — published LAN ports
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
|
||||
# --- Plex (existing, kept) ---
|
||||
http://plex.franksdank.casa {
|
||||
reverse_proxy 192.168.0.235:32400
|
||||
}
|
||||
|
||||
http://plex.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:32400
|
||||
}
|
||||
|
||||
# --- Calibre-Web ---
|
||||
http://books.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:8083
|
||||
}
|
||||
|
||||
# --- RomM ---
|
||||
http://romm.franksdank.cloud {
|
||||
basicauth {
|
||||
dank $2a$14$REPLACE_WITH_HASH
|
||||
}
|
||||
reverse_proxy loki:3100
|
||||
reverse_proxy 192.168.0.235:8085
|
||||
}
|
||||
|
||||
# --- Copyparty ---
|
||||
http://files.franksdank.cloud {
|
||||
basicauth {
|
||||
dank $2a$14$REPLACE_WITH_HASH
|
||||
}
|
||||
reverse_proxy 192.168.0.235:3923
|
||||
}
|
||||
|
||||
# --- Jellyfin ---
|
||||
http://jellyfin.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:8096
|
||||
|
||||
transport http {
|
||||
versions h2c 1.1
|
||||
}
|
||||
}
|
||||
|
||||
# --- *arr Stack ---
|
||||
http://radarr.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:7878
|
||||
}
|
||||
|
||||
http://sonarr.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:8989
|
||||
}
|
||||
|
||||
http://lidarr.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:8686
|
||||
}
|
||||
|
||||
http://readarr.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:8787
|
||||
}
|
||||
|
||||
http://prowlarr.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:9696
|
||||
}
|
||||
|
||||
http://qbittorrent.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.235:8080
|
||||
}
|
||||
|
||||
# --- Optional: Jackett ---
|
||||
# http://jackett.franksdank.cloud {
|
||||
# reverse_proxy 192.168.0.235:9117
|
||||
# }
|
||||
|
||||
# --- Optional: Whisparr ---
|
||||
# http://whisparr.franksdank.cloud {
|
||||
# reverse_proxy 192.168.0.235:6969
|
||||
# }
|
||||
Reference in new issue
Block a user