# Dankclaw Caddyfile
# Reverse proxy for the Dankclaw stack. Caddy runs as a container on the
# podman network; upstreams are container names. Homepage is password
# protected. Replace the bcrypt hashes below (caddy hash-password) at deploy.
#
# Naming: flat franksdank.cloud scheme (see docs/Infrastructure/Domain-DNS.md).
# DNS for these names is served by the dnsmasq quadlet on this host
# (dankclaw/dnsmasq/addn-hosts) and handed to LAN clients by the SURFboard
# G36 router (DNS Relay -> statically configured -> 192.168.0.143).
#
# Phase 1 uses explicit http:// site addresses (no TLS yet). Phase 2 drops
# the prefix and adds a wildcard Let's Encrypt cert via DNS-01 (Porkbun).

{
	admin off
	email admin@franksdank.cloud
}

# --- Bare-IP access (health checks, convenience) ---
:80 {
	redir http://dankclaw.franksdank.cloud/ 302
}

# --- Homepage (password protected) ---
http://dankclaw.franksdank.cloud {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	root * /srv/homepage
	file_server
}

# --- SearXNG (behind the Gluetun tunnel) ---
http://search.franksdank.cloud {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy gluetun:8080
}

# --- ComfyUI ---
http://comfyui.franksdank.cloud {
	reverse_proxy comfyui:8188
}

# --- OpenWebUI ---
# open-webui is a quadlet container on slirp4netns (isolated), so Caddy cannot
# reach it by container name. Proxy to its published LAN port instead.
http://chat.franksdank.cloud {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy 192.168.0.143:3005
}

# --- Hermes ---
http://hermes.franksdank.cloud {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy hermes:8090
}

# --- Gitea (migrated) ---
http://gitea.franksdank.cloud {
	reverse_proxy gitea-server:3000
}

# --- Grafana ---
http://grafana.franksdank.cloud {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy grafana:3000
}

# --- Prometheus ---
http://prometheus.franksdank.cloud {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy prometheus:9090
}

# --- Loki ---
http://loki.franksdank.cloud {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy loki:3100
}