# Caddy

Caddy is the reverse proxy for both hosts. It terminates TLS, routes hostnames to containers, and protects the homepage with HTTP basic auth.

**Hosts:** Dankserver + Dankclaw — **Docs:** https://caddyserver.com/docs

## Facts (from live inventory + knowledge base)

| Item | Value |
|------|-------|
| Image | `docker.io/library/caddy:latest` |
| Config | `/etc/caddy/Caddyfile` (bind mount) |
| Data | `/root/.local/share/caddy` (certs, ACME state) |
| Ports | 80, 443 |
| Existing on Dankserver | systemd `caddy` service (native), config at `/etc/caddy/Caddyfile` — being migrated into this repo |

## Existing Dankserver Caddyfile (live, to migrate)

The live Caddyfile proxies:
- `plex.franksdank.casa` / `plex.franksdank.cloud` / `plex.dankserver.local` → `localhost:32400` (Plex)
- `books.franksdank.cloud` → `localhost:8083` (Calibre-Web)
- `llms.franksdank.cloud` / `llms.dankserver.local` → `localhost:3000` (OpenWebUI — being moved to Dankclaw)
- `search.dankserver.local` → `localhost:8081` (SearXNG — being moved to Dankclaw)

## Hostname Convention

Every service gets a `.dankserver.local` or `.dankclaw.local` hostname so no one has to remember port numbers:

```
romm.dankserver.local
books.dankserver.local
files.dankserver.local
search.dankclaw.local
chat.dankclaw.local
gitea.dankclaw.local
comfyui.dankclaw.local
grafana.dankclaw.local
prometheus.dankclaw.local
```

## Basic Auth

Generate a bcrypt hash with `caddy hash-password`, then:

```
chat.dankclaw.local {
    basicauth {
        dank $2a$14$xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    }
    reverse_proxy localhost:3000
}
```

The homepage uses basic auth too; see [[Homepage]].

## Homepage

A static page lists all services with live status (up/down) and a short description plus a link to each service's documentation. Served by Caddy with `file_server` and protected by basic auth.

## Gotchas

- Caddy auto-provisions Let's Encrypt certs for public domains; `.local` names stay internal (no external DNS).
- Validate before reload: `caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile`.
- Certificates live in the caddy data volume; back it up with the stack.

## See Also

- [[Dankserver Stack]]
- [[Dankclaw Stack]]
- [[Homepage]]
- Knowledge base: [[Gitea Architecture]] (the existing caddy chain on Dankclaw)