Frank
4a679fce80
Per user direction, Caddy runs only on dankclaw. It fronts every service on both hosts: local services by container name, quadlet services by published LAN port, dankserver services by published LAN port (192.168.0.235:PORT). - dankclaw/Caddyfile: merged vhost list (was: two Caddyfiles, one per host). gitea's single vhost moves in from the retired gitea-caddy quadlet (option B). Upstreams fixed to live reality: gitea :3000, search :8081 (gluetun), chat :3005 (open-webui quadlet), media services via 192.168.0.235. Retired: llms (open-webui on dankserver is removed; chat is its successor), the dankserver homepage (302 to the shared one). - dankserver/Caddyfile, dankclaw/gitea/Caddyfile: deleted (git rm). - dnsmasq addn-hosts: every name -> 192.168.0.143 (the one Caddy host); no .235 records, no llms. - compose.yaml: removed the openwebui/postgres/gitea services (they are quadlets now); caddy service mounts the rendered Caddyfile from /home/dank/Containers/caddy, healthcheck probes the bare-IP catch-all (302). - deploy.sh: per-target logic (dankserver = pull-only, health via the shared Caddy at 192.168.0.143); renders CADDY_BASICAUTH_HASH from the host .env into the mounted Caddyfile. - .env.example: CADDY_BASICAUTH_HASH on dankclaw; Porkbun block dropped from dankserver (its Caddy is gone); SEARXNG_BASE_URL to the flat name; stale OPENAI_* block dropped (quadlet is self-contained). - tests: caddyfile.bats now asserts the single-Caddyfile invariant; dnsmasq.bats cross-checks vhosts -> .143 and the retired names.
42 lines
1.4 KiB
Bash
42 lines
1.4 KiB
Bash
# Dankclaw stack secrets and configuration.
|
|
# Copy to .env and fill real values. Never commit real secrets.
|
|
|
|
# SearXNG
|
|
SEARXNG_SECRET=changeme
|
|
SEARXNG_BASE_URL=http://search.franksdank.cloud/
|
|
|
|
# Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
|
|
# Single-peer WireGuard model. Fill from your provider's WireGuard config.
|
|
VPN_SERVICE_PROVIDER=protonvpn
|
|
VPN_TYPE=wireguard
|
|
WIREGUARD_PRIVATE_KEY=changeme
|
|
WIREGUARD_ADDRESSES=0.0.0.0/32
|
|
WIREGUARD_PUBLIC_KEY=changeme
|
|
WIREGUARD_ENDPOINT_IP=0.0.0.0
|
|
WIREGUARD_ENDPOINT_PORT=51820
|
|
WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
|
|
WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
|
|
|
|
# Gitea database
|
|
GITEA_DB_PASSWORD=changeme
|
|
|
|
# Grafana admin
|
|
GRAFANA_ADMIN_USER=admin
|
|
GRAFANA_ADMIN_PASSWORD=changeme
|
|
|
|
# Caddy (the homelab's single reverse proxy, on this host)
|
|
# bcrypt hash of the homepage/protected-vhost password (caddy hash-password).
|
|
# deploy.sh renders it into /home/dank/Containers/caddy/Caddyfile.
|
|
CADDY_BASICAUTH_HASH=changeme
|
|
|
|
# Hermes -> Signal (signal-cli daemon on the host, port 8080)
|
|
# E.164 number of the linked Signal account (your primary number, for Note-to-Self).
|
|
SIGNAL_ACCOUNT=+15551234567
|
|
# Comma-separated E.164 numbers allowed to message the agent.
|
|
SIGNAL_ALLOWED_USERS=+15551234567
|
|
|
|
# Porkbun API (franksdank.cloud zone). Caddy uses these for DNS-01
|
|
# Let's Encrypt wildcard cert issuance. Scope the token to this zone only.
|
|
PORKBUN_API_KEY=changeme
|
|
PORKBUN_API_SECRET=changeme
|