Frank
7f4ce06927
- Caddyfile: drop http:// site prefixes, global acme_dns porkbun block, HTTPS redirects on the bare-IP and legacy vhosts - new dankclaw/caddy/Containerfile: xcaddy build with caddy-dns/porkbun - compose: caddy uses franksdank/caddy-porkbun:latest + Porkbun env vars - deploy.sh: build the image on first deploy if missing - .env.example: rename PORKBUN_API_SECRET -> PORKBUN_API_SECRET_KEY (the name the caddy-dns/porkbun module expects) - tests: 7 new caddyfile/compose seams for the TLS config
44 lines
1.5 KiB
Bash
44 lines
1.5 KiB
Bash
# Dankclaw stack secrets and configuration.
|
|
# Copy to .env and fill real values. Never commit real secrets.
|
|
|
|
# SearXNG
|
|
SEARXNG_SECRET=changeme
|
|
SEARXNG_BASE_URL=http://search.franksdank.cloud/
|
|
|
|
# Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
|
|
# Single-peer WireGuard model. Fill from your provider's WireGuard config.
|
|
VPN_SERVICE_PROVIDER=protonvpn
|
|
VPN_TYPE=wireguard
|
|
WIREGUARD_PRIVATE_KEY=changeme
|
|
WIREGUARD_ADDRESSES=0.0.0.0/32
|
|
WIREGUARD_PUBLIC_KEY=changeme
|
|
WIREGUARD_ENDPOINT_IP=0.0.0.0
|
|
WIREGUARD_ENDPOINT_PORT=51820
|
|
WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
|
|
WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
|
|
|
|
# Gitea database
|
|
GITEA_DB_PASSWORD=changeme
|
|
|
|
# Grafana admin
|
|
GRAFANA_ADMIN_USER=admin
|
|
GRAFANA_ADMIN_PASSWORD=changeme
|
|
|
|
# Caddy (the homelab's single reverse proxy, on this host)
|
|
# bcrypt hash of the homepage/protected-vhost password (caddy hash-password).
|
|
# deploy.sh renders it into /home/dank/Containers/caddy/Caddyfile.
|
|
CADDY_BASICAUTH_HASH=changeme
|
|
|
|
# Hermes -> Signal (signal-cli daemon on the host, port 8080)
|
|
# E.164 number of the linked Signal account (your primary number, for Note-to-Self).
|
|
SIGNAL_ACCOUNT=+15551234567
|
|
# Comma-separated E.164 numbers allowed to message the agent.
|
|
SIGNAL_ALLOWED_USERS=+15551234567
|
|
|
|
# Porkbun API (franksdank.cloud + franksdank.casa zones). Caddy uses these
|
|
# for DNS-01 Let's Encrypt wildcard cert issuance. Porkbun API keys are
|
|
# account-wide; rotate them here rather than in the dashboard.
|
|
# PORKBUN_API_SECRET_KEY is the name the caddy-dns/porkbun module expects.
|
|
PORKBUN_API_KEY=changeme
|
|
PORKBUN_API_SECRET_KEY=changeme
|