From f846768a5409772f17f752837b43ed998bcfb90e Mon Sep 17 00:00:00 2001 From: john Date: Sat, 13 Jun 2026 12:23:10 +0100 Subject: [PATCH] Upload files to "caddy" Latest working with Authelia --- caddy/Caddyfile | 188 +++++++++++++++++++++++++++--------------------- 1 file changed, 105 insertions(+), 83 deletions(-) diff --git a/caddy/Caddyfile b/caddy/Caddyfile index 65b1865..5b08b3d 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -2,7 +2,7 @@ { # Global options, omly one such block at the head of the file servers { - trusted_proxies static 192.168.1.0/24 2a00:23c6::/32 + trusted_proxies static 192.168.1.0/24 10.0.0.0/24 2a00:23c6::/32 } # make admin available to all trusted nodes on the network admin :2019 @@ -11,19 +11,19 @@ # # -# For Authelis +# For Authelia # (trusted_proxy_list) { - trusted_proxies 192.168.1.0/24 2a00:23c6::/32 + trusted_proxies 192.168.1.0/24 10.0.0.0/24 2a00:23c6::/32 } (secure_site) { - forward_auth {args[0]} 192.168.1.1:9091 { - uri /api/verify?rd=https://auth.johnsnexus.click - copy_headers Remote-User Remote-Groups Remote-Name Remote-Email - import trusted_proxy_list - header_up Host {upstream_hostport} - } + forward_auth {args[0]} 192.168.1.1:9091 { + uri /api/verify?rd=https://auth.johnsnexus.click + copy_headers Remote-User Remote-Groups Remote-Name Remote-Email + import trusted_proxy_list + header_up Host {upstream_hostport} + } } # # it appears you need this to allow prometheus on a remote node to scrape the metrics @@ -36,8 +36,8 @@ # Snippet for basic authorisation # (basic-auth) { - basic_auth { - john.anderson $2a$10$T.yetVs9CmektYsaU8RqYu37fVaFAsPDLf90lsDDfxLkaC.zWH3Oi + basic_auth { + john.anderson $2a$10$4ka55bXqNBpoQcBDrJtd5OQje6Nt/HmvRNAGavqO03xq/Noth5xH. mary.anderson $2a$10$UOuB5DpDcKRho0rRPDCmCeFlDSx/f6Bkwqpw8CEeQCbAGA0yULcny frazer.anderson $2a$10$UleGw5O0BB18XtSenFSawudO.qKbNVMFU772XMP4cAAUbWzRo/zr6 chris.anderson $2a$10$1MeL9m8M7FW/k6/DW3HB1.rkijS3qao8RraNO/tJKN8OuRTCzc3fK @@ -55,9 +55,10 @@ barbara.wright $2a$10$Mlp0Y2wPzzomL1EnTInS2u18yv7ksMY.ATURzQz4luRRe2JwBMEJS janet.kennedy $2a$10$/8VCpm68CLSF2zSL5sHtR.hzwJ.h3cX3r8XHogHbz8o7KIYPDHOVW } +# respond "Welcome, {http.auth.user.id}" 200 } # -# Authelia from HOSTS +# tinyauth running on LXC # auth.johnsnexus.click { reverse_proxy 192.168.1.1:9091 { @@ -67,9 +68,9 @@ auth.johnsnexus.click { # # Locally hosted site # -testcaddy.johnsnexus.click { +testcaddy.home.johnsnexus.click { root * /usr/share/caddy # compose file points to this - php_fastcgi 192.168.1.1:80 + php_fastcgi 192.168.1.11:80 file_server } # @@ -88,19 +89,19 @@ https://hold.johnsnexus.click { reverse_proxy 192.168.1.5:1411 } # -# Test GHOST site on ELITE cluster +# Test GHOST site on BETA # -ghost.johnsnexus.click { - root * /var/www/mymag - file_server - reverse_proxy 192.168.1.4:2368 -} +#ghost.johnsnexus.click { +# root * /var/www/mymag +# file_server +# reverse_proxy 192.168.1.9:2368 +#} # -# Fanily History Web site on Production cluster system, come here via HOSTS file +# Fanily History Web site on Production cluster system, come here via BIND9 # nextfamhistweb.johnsnexus.click { # import basic-auth - import secure_site * +# import secure_site * # root * /usr/local/apache2/htdocs # file_server reverse_proxy nextfamhistweb_nextfamhistweb { @@ -108,61 +109,87 @@ nextfamhistweb.johnsnexus.click { } } # -# Test web site on Production Cluster, come here via HOSTS file -# an example of a non-secure site on a different domain +# Test web site on Production Cluster, come here via BIND9 # -http://northweb.johns.study { - import basic-auth - root * /usr/local/apache2/htdocs +northweb.home.johnsnexus.click { + import secure_site * +# import basic-auth file_server reverse_proxy testweb_testweb } # -# Test version of paperless-ngx on Elite cluster, come here via HOSTS file +# Test version of paperless-ngx on OMEGA come here via BIND9 # wastebin.johnsnexus.click { file_server - reverse_proxy 192.168.1.4:8600 + reverse_proxy 192.168.1.5:8600 } # # Version of pydio cells on NODE-16 using SAMBA volume - DYNU public address # -pydiocells.johnsnexus.click { +#pydiocells.johnsnexus.click { # tls tls@johnsnexus.click - reverse_proxy 192.168.1.4:8888 { - transport http { - tls - tls_insecure_skip_verify - } - } -} +# reverse_proxy 192.168.1.4:8888 { +# transport http { +# tls +# tls_insecure_skip_verify +# } +# } +#} # -# Nextcloud AIO on NODE-16, was Beta (220 or 9) +# NEXTCLOUDAIO on virtual node 22, via DYNU # -https://amudanan.johnsnexus.click:443 { - header Strict-Transport-Security max-age=15552000 +amudanan.johnsnexus.click { file_server - reverse_proxy http://192.168.1.16:11000 + reverse_proxy 192.168.1.22:11000 } # -# OWNCLOUD on BEES swarm via DYNU +#codeamud.johnsnexus.click { +# file_server +# reverse_proxy 192.168.1.26:9980 { +# header_up X-Forwarded-Proto {scheme} +# transport http { +# tls_insecure_skip_verify +# } +# } +#} +# +# OWNCLOUD on vmnode21 # mycloud.johnsnexus.click { header Strict-Transport-Security max-age=15552000 file_server - reverse_proxy 192.168.1.3:8080 + reverse_proxy 192.168.1.21:8080 } # code.johnsnexus.click { - encode gzip file_server - reverse_proxy https://192.168.1.3:9980 { - transport http { - tls_insecure_skip_verify - } + reverse_proxy 192.168.1.21:9980 { + header_up X-Forwarded-Proto {scheme} +# transport http { +# tls_insecure_skip_verify +# } } } # +# TESTCLOUD/Nextcloud Alpine on ZETA +#testcloud.johnsnexus.click { +# file_server +# reverse_proxy 192.168.1.26 +#} +# +# TESTCLOUD/nextcloud-alpine in a secure LXC on ZETA +# +#testcloud.home.johnsnexus.click { +# header Strict-Transport-Security max-age=15552000 +# file_server +# reverse_proxy https://192.168.1.232:443 { +# transport http { +# tls_insecure_skip_verify +# } +# } +#} +# # Vaultwarden on Production Cluster, come here via HOSTS # #warden.johnsnexus.click { @@ -178,60 +205,55 @@ https://chord.johnsnexus.click { ## # n8n running on DELTA, come here via DYNU # -donut.johnsnexus.click { - reverse_proxy http://192.168.1.10:5678 { - flush_interval -1 - } -} +#donut.johnsnexus.click { +# reverse_proxy http://192.168.1.10:5678 { +# flush_interval -1 +# } +#} # -# CTiO magazine using Ghost on production +# CTiO magazine using NICEPAGE on PROXMOX # ctio.johnsnexus.click { file_server - reverse_proxy 192.168.1.1:2368 + reverse_proxy ctiomag_ctiomag } # #**************************************** # -# Hoarder from hosts file, keep in extenal domain -# Needs SSL; leave as explicit address; use 3200 as gitea uses 3000 +# Needs SSL; # -hoarder.johnsnexus.click { - reverse_proxy 192.168.1.4:3200 +https://hoarder.home.johnsnexus.click { + file_server + reverse_proxy 192.168.1.234:3000 } # -# # although "prod" it runs on Elite Cluster -grafana.johnsnexus.click { -# file_server - reverse_proxy 192.168.1.4:3030 -} -# new gitea on elite cluster -mygit.johnsnexus.click { - reverse_proxy 192.168.1.4:3000 -} +# runs on virtual LXC # -# copy of mygit on the production cluster -gitea.johnsnexus.click { +https://grafana.home.johnsnexus.click { file_server - reverse_proxy 192.168.1.1:3000 + reverse_proxy 192.168.1.237:3000 } # -gotify.johnsnexus.click { - reverse_proxy 192.168.1.4:8111 +# runs on virtual LXC +lldap.home.johnsnexus.click { + file_server + reverse_proxy 192.168.1.26:17170 } # -# Portainer manageed on ELITE cluster, come here via HOSTS -# Use port 9000 not 9443 -portainer.johnsnexus.click { - reverse_proxy 192.168.1.4:9000 +# copy of mygit on the proxmox cluster +gitea.home.johnsnexus.click { + file_server + reverse_proxy 192.168.1.235:3000 } # -# Open Media Vault from HOSTS file -# -omv.valhalla.johnsnexus.click { - reverse_proxy 192.168.1.7 +# now a cirtual container on PROXMOX +gotify.home.johnsnexus.click { + reverse_proxy 192.168.1.230:80 } # -omv.paradise.johnsnexus.click { - reverse_proxy 192.168.1.8 +# New home assistant, running under docker on NODE-16 via wireless +https://have.johnsnexus.click { + file_server + reverse_proxy 192.168.1.16:8123 } +