# Dankclaw Caddyfile
# Reverse proxy for the Dankclaw stack. Caddy runs as a container on the
# podman network; upstreams are container names. Homepage is password
# protected. Replace the bcrypt hashes below (caddy hash-password) at deploy.

{
	admin off
	email admin@dankclaw.local
}

# --- Homepage (password protected) ---
dankclaw.local {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	root * /srv/homepage
	file_server
}

# --- SearXNG (behind the Gluetun tunnel) ---
search.dankclaw.local {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy gluetun:8080
}

# --- ComfyUI ---
comfyui.dankclaw.local {
	reverse_proxy comfyui:8188
}

# --- OpenWebUI ---
# open-webui is a quadlet container on slirp4netns (isolated), so Caddy cannot
# reach it by container name. Proxy to its published LAN port instead.
chat.dankclaw.local {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy 192.168.0.143:3005
}

# --- Hermes ---
hermes.dankclaw.local {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy hermes:8090
}

# --- Gitea (migrated) ---
gitea.dankclaw.local {
	reverse_proxy gitea-server:3000
}

# --- Grafana ---
grafana.dankclaw.local {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy grafana:3000
}

# --- Prometheus ---
prometheus.dankclaw.local {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy prometheus:9090
}

# --- Loki ---
loki.dankclaw.local {
	basicauth {
		dank $2a$14$REPLACE_WITH_HASH
	}
	reverse_proxy loki:3100
}