Frank
e3eb5334cb
- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter - Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy reverse proxy, Grafana+Prometheus+Loki+Alloy observability - Caddyfiles with .local hostname convention and basicauth homepage - bind-mount storage policy, no named volumes - deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health) - docs/ Obsidian vault: per-service docs from frank-default-small research subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu) - bats test suite at 6 seams — 22 tests green
71 lines
2.3 KiB
Markdown
71 lines
2.3 KiB
Markdown
# Caddy
|
|
|
|
Caddy is the reverse proxy for both hosts. It terminates TLS, routes hostnames to containers, and protects the homepage with HTTP basic auth.
|
|
|
|
**Hosts:** Dankserver + Dankclaw — **Docs:** https://caddyserver.com/docs
|
|
|
|
## Facts (from live inventory + knowledge base)
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Image | `docker.io/library/caddy:latest` |
|
|
| Config | `/etc/caddy/Caddyfile` (bind mount) |
|
|
| Data | `/root/.local/share/caddy` (certs, ACME state) |
|
|
| Ports | 80, 443 |
|
|
| Existing on Dankserver | systemd `caddy` service (native), config at `/etc/caddy/Caddyfile` — being migrated into this repo |
|
|
|
|
## Existing Dankserver Caddyfile (live, to migrate)
|
|
|
|
The live Caddyfile proxies:
|
|
- `plex.franksdank.casa` / `plex.franksdank.cloud` / `plex.dankserver.local` → `localhost:32400` (Plex)
|
|
- `books.franksdank.cloud` → `localhost:8083` (Calibre-Web)
|
|
- `llms.franksdank.cloud` / `llms.dankserver.local` → `localhost:3000` (OpenWebUI — being moved to Dankclaw)
|
|
- `search.dankserver.local` → `localhost:8081` (SearXNG — being moved to Dankclaw)
|
|
|
|
## Hostname Convention
|
|
|
|
Every service gets a `.dankserver.local` or `.dankclaw.local` hostname so no one has to remember port numbers:
|
|
|
|
```
|
|
romm.dankserver.local
|
|
books.dankserver.local
|
|
files.dankserver.local
|
|
search.dankclaw.local
|
|
chat.dankclaw.local
|
|
gitea.dankclaw.local
|
|
comfyui.dankclaw.local
|
|
grafana.dankclaw.local
|
|
prometheus.dankclaw.local
|
|
```
|
|
|
|
## Basic Auth
|
|
|
|
Generate a bcrypt hash with `caddy hash-password`, then:
|
|
|
|
```
|
|
chat.dankclaw.local {
|
|
basicauth {
|
|
dank $2a$14$xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
|
}
|
|
reverse_proxy localhost:3000
|
|
}
|
|
```
|
|
|
|
The homepage uses basic auth too; see [[Homepage]].
|
|
|
|
## Homepage
|
|
|
|
A static page lists all services with live status (up/down) and a short description plus a link to each service's documentation. Served by Caddy with `file_server` and protected by basic auth.
|
|
|
|
## Gotchas
|
|
|
|
- Caddy auto-provisions Let's Encrypt certs for public domains; `.local` names stay internal (no external DNS).
|
|
- Validate before reload: `caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile`.
|
|
- Certificates live in the caddy data volume; back it up with the stack.
|
|
|
|
## See Also
|
|
|
|
- [[Dankserver Stack]]
|
|
- [[Dankclaw Stack]]
|
|
- [[Homepage]]
|
|
- Knowledge base: [[Gitea Architecture]] (the existing caddy chain on Dankclaw) |