Frank
1dee2b737e
/opt is root-owned; the established data-location pattern (see docs/Architecture/Storage Policy.md, open-webui quadlet) is /home/dank/Containers/<service>.
92 lines
2.1 KiB
Caddyfile
92 lines
2.1 KiB
Caddyfile
# Dankclaw Caddyfile
|
|
# Reverse proxy for the Dankclaw stack. Caddy runs as a container on the
|
|
# podman network; upstreams are container names. Homepage is password
|
|
# protected. Replace the bcrypt hashes below (caddy hash-password) at deploy.
|
|
#
|
|
# Naming: flat franksdank.cloud scheme (see docs/Infrastructure/Domain-DNS.md).
|
|
# DNS for these names is served by the dnsmasq quadlet on this host
|
|
# (dankclaw/dnsmasq/addn-hosts) and handed to LAN clients by the SURFboard
|
|
# G36 router (DNS Relay -> statically configured -> 192.168.0.143).
|
|
#
|
|
# Phase 1 uses explicit http:// site addresses (no TLS yet). Phase 2 drops
|
|
# the prefix and adds a wildcard Let's Encrypt cert via DNS-01 (Porkbun).
|
|
{
|
|
admin off
|
|
email admin@franksdank.cloud
|
|
}
|
|
|
|
# --- Bare-IP access (health checks, convenience) ---
|
|
:80 {
|
|
redir http://dankclaw.franksdank.cloud/ 302
|
|
}
|
|
|
|
# --- Homepage (password protected) ---
|
|
http://dankclaw.franksdank.cloud {
|
|
basicauth {
|
|
dank $2a$14$REPLACE_WITH_HASH
|
|
}
|
|
root * /srv/homepage
|
|
file_server
|
|
}
|
|
|
|
# --- SearXNG (behind the Gluetun tunnel) ---
|
|
http://search.franksdank.cloud {
|
|
basicauth {
|
|
dank $2a$14$REPLACE_WITH_HASH
|
|
}
|
|
reverse_proxy gluetun:8080
|
|
}
|
|
|
|
# --- ComfyUI ---
|
|
http://comfyui.franksdank.cloud {
|
|
reverse_proxy comfyui:8188
|
|
}
|
|
|
|
# --- OpenWebUI ---
|
|
# open-webui is a quadlet container on slirp4netns (isolated), so Caddy cannot
|
|
# reach it by container name. Proxy to its published LAN port instead.
|
|
http://chat.franksdank.cloud {
|
|
basicauth {
|
|
dank $2a$14$REPLACE_WITH_HASH
|
|
}
|
|
reverse_proxy 192.168.0.143:3005
|
|
}
|
|
|
|
# --- Hermes ---
|
|
http://hermes.franksdank.cloud {
|
|
basicauth {
|
|
dank $2a$14$REPLACE_WITH_HASH
|
|
}
|
|
reverse_proxy hermes:8090
|
|
}
|
|
|
|
# --- Gitea (migrated) ---
|
|
http://gitea.franksdank.cloud {
|
|
reverse_proxy gitea-server:3000
|
|
}
|
|
|
|
# --- Grafana ---
|
|
http://grafana.franksdank.cloud {
|
|
basicauth {
|
|
dank $2a$14$REPLACE_WITH_HASH
|
|
}
|
|
reverse_proxy grafana:3000
|
|
}
|
|
|
|
# --- Prometheus ---
|
|
http://prometheus.franksdank.cloud {
|
|
basicauth {
|
|
dank $2a$14$REPLACE_WITH_HASH
|
|
}
|
|
reverse_proxy prometheus:9090
|
|
}
|
|
|
|
# --- Loki ---
|
|
http://loki.franksdank.cloud {
|
|
basicauth {
|
|
dank $2a$14$REPLACE_WITH_HASH
|
|
}
|
|
reverse_proxy loki:3100
|
|
}
|