From a5dfc1ee995f3b24de4830ec5b4c23d29d4d6d46 Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 3 Nov 2026 00:55:02 -0800 Subject: [PATCH] feat(caddy): serve Audiobookshelf at a guarded abs.franksdank.cloud Provider-first exposure: the IdP row (proxy provider abs-proxy + application "Audiobookshelf Guard", claimed by the embedded outpost) already exists, so the route can ship. The site block proxies everything to anubis:8923 like every other guarded vhost, and the post-auth :8017 handler routes the host to 192.168.0.235:8000. The container carries ROUTER_BASE_PATH=/audiobookshelf, so the app has no root: the bare / is redirected onto the base path inside the post-auth handler, never pre-auth, so an anonymous client only ever meets the gate. --- dankclaw/Caddyfile | 22 ++++++++++++++++++++++ dankclaw/pihole/addn-hosts | 1 + 2 files changed, 23 insertions(+) diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile index e2bdbdb..2243ca6 100644 --- a/dankclaw/Caddyfile +++ b/dankclaw/Caddyfile @@ -264,6 +264,19 @@ files.franksdank.cloud { } } +# --- Audiobookshelf (guarded) --- +# Anubis → Authentik → app, like romm/files. The container carries +# ROUTER_BASE_PATH=/audiobookshelf, so this vhost serves the app under that +# path; the bare root is redirected onto it in the post-auth listener, never +# pre-auth. Guard state in the IdP: proxy provider `abs-proxy` +# (external_host https://abs.franksdank.cloud/, internal_host http://caddy:8017, +# application "Audiobookshelf Guard"), claimed by the embedded outpost. +abs.franksdank.cloud { + reverse_proxy anubis:8923 { + header_up X-Real-Ip {remote_host} + } +} + # --- Jellyfin --- jelly.franksdank.cloud { reverse_proxy 192.168.0.235:8096 @@ -410,6 +423,15 @@ http://:8017 { reverse_proxy 192.168.0.235:3923 } + @abs host abs.franksdank.cloud + handle @abs { + # The app answers only under its ROUTER_BASE_PATH; the bare root is a + # convenience hop, taken post-auth so nothing reaches the app + # pre-authentication. + redir / /audiobookshelf/ permanent + reverse_proxy 192.168.0.235:8000 + } + @prowlarr host prowlarr.franksdank.cloud handle @prowlarr { reverse_proxy 192.168.0.112:9696 diff --git a/dankclaw/pihole/addn-hosts b/dankclaw/pihole/addn-hosts index 327082d..51abc29 100644 --- a/dankclaw/pihole/addn-hosts +++ b/dankclaw/pihole/addn-hosts @@ -26,6 +26,7 @@ 192.168.0.143 romm.franksdank.cloud 192.168.0.143 files.franksdank.cloud 192.168.0.143 jelly.franksdank.cloud +192.168.0.143 abs.franksdank.cloud 192.168.0.143 radarr.franksdank.cloud 192.168.0.143 lidarr.franksdank.cloud 192.168.0.143 readarr.franksdank.cloud