fix: Fixes merge conflicts.

.gitea/workflows/ci.yaml

@@ -0,0 +1,55 @@
+# name: CI
+#
+# on:
+#   push:
+#     branches:
+#       - main
+#   pull_request: {}
+#   workflow_dispatch: {}
+#
+# jobs:
+#   release:
+#     runs-on: ubuntu-latest
+#     steps:
+#       - name: Checkout
+#         uses: actions/checkout@v4
+#         with:
+#           lfs: true
+#
+#       - name: Setup QEMU
+#         uses: docker/setup-qemu-action@v3
+#
+#       - name: Setup docker buildx
+#         uses: docker/setup-buildx-action@v3
+#
+#       - name: Login to Container Registery
+#         uses: docker/login-action@v3
+#         with:
+#           registry: git.housh.dev
+#           username: ${{ secrets.DOCKER_USERNAME }}
+#           password: ${{ secrets.DOCKER_PASSWORD }}
+#
+#       - name: Extract metadata for Docker
+#         id: meta
+#         uses: docker/metadata-action@v5
+#         with:
+#           images: git.housh.dev/homelab/caddy
+#           tags: |
+#             type=schedule
+#             type=ref,event=branch
+#             type=ref,event=pr
+#             type=semver,pattern={{version}}
+#             type=semver,pattern={{major}}.{{minor}}
+#             type=semver,pattern={{major}}
+#             type=sha
+#             type=raw,value=latest
+#
+#       - name: Build and push Docker image
+#         uses: docker/build-push-action@v6
+#         with:
+#           context: .
+#           file: ./Dockerfile
+#           platforms: linux/arm64
+#           push: true
+#           tags: ${{ steps.meta.outputs.tags }}
+#           labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -0,0 +1 @@
+.env

Dockerfile

@@ -1,7 +1,23 @@
-FROM docker.io/library/caddy:2.9.1-builder as builder
+# Adapted from: https://github.com/crowdsecurity/example-docker-compose/blob/main/caddy/Caddyfile
+#
+# the different stages of this Dockerfile are meant to be built into separate images
+# https://docs.docker.com/develop/develop-images/multistage-build/#stop-at-a-specific-build-stage
+# https://docs.docker.com/compose/compose-file/#target
+
+# https://docs.docker.com/engine/reference/builder/#understand-how-arg-and-from-interact
+ARG CADDY_VERSION=2
+
+FROM caddy:${CADDY_VERSION}-builder-alpine AS builder
 
 RUN xcaddy build \
-  --with github.com/caddy-dns/cloudflare
+  --with github.com/caddy-dns/cloudflare \
+  --with github.com/mholt/caddy-l4 \
+  --with github.com/caddyserver/transform-encoder \
+  --with github.com/hslatman/caddy-crowdsec-bouncer/http@main \
+  --with github.com/hslatman/caddy-crowdsec-bouncer/layer4@main
+
+FROM caddy:${CADDY_VERSION} AS caddy
+
+WORKDIR /
 
-FROM docker.io/library/caddy:2.9.1-alpine
 COPY --from=builder /usr/bin/caddy /usr/bin/caddy

README.md

@@ -1,3 +1,18 @@
 # caddy
 
-Caddy reverse proxy.
+Caddy reverse proxy, [caddy](https://caddyserver.com/docs/quick-starts/reverse-proxy)
+
+This repository includes the reverse-proxy for the domain's hosted under `*.housh.dev`. The primary
+proxy is on the `main` branch, there are also proxies that run on each server, that can be found on
+the other branches of this repository.
+
+This allows TLS to all backend services from the `primary` proxy.
+
+They all share the same `Dockerfile` and `compose.yaml` file, the only differences are the
+`config/Caddyfile`.
+
+## Usage
+
+1. Clone the repository onto your host, or setup through your container manager (such as komodo).
+2. Copy the `example.env` file to `.env` and update the environment variables.
+3. Deploy the proxy `sudo docker compose --env-file .env up -d`

compose.yaml

@@ -2,7 +2,7 @@ services:
   caddy:
     build:
       context: .
-      dockerfile: Dockerfile
+      target: caddy
     container_name: caddy
     restart: unless-stopped
     env_file:
@@ -11,6 +11,7 @@ services:
       - CLOUDFLARE_EMAIL=${CF_EMAIL}
       - CLOUDFLARE_API_TOKEN=${CF_AUTH_TOKEN}
       - ACME_AGREE=true
+      - CROWDSEC_API_KEY=${CROWDSEC_API_KEY}
     ports:
       - 80:80
       - 443:443
@@ -18,17 +19,39 @@ services:
     cap_add:
       - NET_ADMIN
     volumes:
-      - ./config:/etc/caddy:z
+      - ./config:/etc/caddy
       - caddy_data:/data
       - caddy_config:/config
+      - caddy_logs:/var/log/caddy
     networks:
       - proxy
     security_opt:
       - no-new-privileges:true
 
+  crowdsec:
+    image: docker.io/crowdsecurity/crowdsec:latest
+    container_name: crowdsec
+    restart: unless-stopped
+    environment:
+      - GID=1000
+      - COLLECTIONS=crowdsecurity/linux crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
+      - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
+    volumes:
+      - crowdsec_db:/var/lib/crowdsec/data/
+      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
+      - caddy_logs:/var/log/caddy:ro
+    networks:
+      - proxy
+    security_opt:
+      - no-new-privileges:true
+    depends_on:
+      - caddy
+
 volumes:
   caddy_data: {}
   caddy_config: {}
+  caddy_logs: {}
+  crowdsec_db: {}
 
 networks:
   proxy:

config/Caddyfile

@@ -1,16 +1,236 @@
 {
     email {env.ACME_EMAIL}
+    servers {
+        client_ip_headers X-Forwarded-For
+        trusted_proxies static private_ranges
+        trusted_proxies_strict
+    }
+    order crowdsec before respond
+    crowdsec {
+          api_url http://crowdsec:8080
+          api_key {$CROWDSEC_API_KEY}
+    }
 }
 
-*.frankenmini.housh.dev {
+# Subdomains
+*.housh.dev {
     tls {
         dns cloudflare {env.CF_AUTH_TOKEN}
         resolvers 1.1.1.1
     }
 
-   @immich host photos.frankenmini.housh.dev
+    log {
-    handle @immich {
+        level INFO
-          reverse_proxy immich-server:2283
+        output file /var/log/caddy/access.log
     }
 
+    @pos host po.housh.dev
+    handle @pos {
+          reverse_proxy http://roguemini.housh.dev:8082
+          crowdsec
+    }
+
+    @legacypos host legacy-po.housh.dev
+    handle @legacypos {
+         reverse_proxy http://roguemini.housh.dev:5000
+          crowdsec
+    }
+
+    @gitea host git.housh.dev
+    handle @gitea {
+         reverse_proxy gitea:3000
+          crowdsec
+    }
+
+    @dash host dash.housh.dev
+    handle @dash {
+         reverse_proxy http://roguemini.housh.dev:7575
+          crowdsec
+    }
+
+    @komodo host komo.housh.dev
+    handle @komodo {
+         reverse_proxy komodo:9120
+          crowdsec
+    }
+
+    @excalidraw host draw.housh.dev
+    handle @excalidraw {
+         reverse_proxy excalidraw:80
+          crowdsec
+    }
+
+    @uptimekuma host uptime.housh.dev
+    handle @uptimekuma {
+          reverse_proxy uptime_kuma:3001
+          crowdsec
+    }
+
+    @immich host photos.housh.dev
+    handle @immich {
+
+      # Immich public proxy.
+      @public path /share /share/*
+      handle @public {
+          reverse_proxy http://frankenmini.housh.dev:3000
+          crowdsec
+      }
+
+      handle {
+          reverse_proxy http://frankenmini.housh.dev:2283
+          crowdsec
+      }
+    }
+
+    @snapp host s.housh.dev
+    handle @snapp {
+          reverse_proxy http://roguemini.housh.dev:3000
+          crowdsec
+    }
+
+    @docs host docs.housh.dev
+    handle @docs {
+          reverse_proxy docs:80
+          crowdsec
+    }
+
+    @pocket_id host id.housh.dev
+    handle @pocket_id {
+          reverse_proxy pocket-id:1411
+          crowdsec
+    }
+
+    @plausible host plausible.housh.dev
+    handle @plausible {
+          reverse_proxy http://roguemini.housh.dev:8004
+          crowdsec
+    }
+
+    @vaultwarden host vaultwarden.housh.dev
+    handle @vaultwarden {
+          reverse_proxy http://roguemini.housh.dev:8888
+          crowdsec
+    }
+
+    @calendar host calendar.housh.dev
+    handle @calendar {
+          reverse_proxy http://frankenmini.housh.dev:5232
+          crowdsec
+    }
+
+    @ollama host ollama.housh.dev
+    handle @ollama {
+          reverse_proxy http://roguemini.housh.dev:3001
+          crowdsec
+    }
+
+		@shlink host l.housh.dev
+		handle @shlink {
+					reverse_proxy http://roguemini.housh.dev:8880
+					crowdsec
+		}
+
+		@shlink_web host shlink.housh.dev
+		handle @shlink_web {
+					reverse_proxy http://roguemini.housh.dev:8881
+					crowdsec
+		}
+
+		######################################################
+		#  Media / *arr stack
+		######################################################
+		@jellyfin host jellyfin.housh.dev
+		handle @jellyfin {
+					reverse_proxy http://frankenmini.housh.dev:8096
+					crowdsec
+		}
+
+		@qbittorrent host qbittorrent.housh.dev
+		handle @qbittorrent {
+					reverse_proxy http://frankenmini.housh.dev:8701
+					crowdsec
+		}
+
+		@prowlarr host prowlarr.housh.dev
+		handle @prowlarr {
+					reverse_proxy http://frankenmini.housh.dev:9696
+					crowdsec
+		}
+
+		@radarr host radarr.housh.dev
+		handle @radarr {
+					reverse_proxy http://frankenmini.housh.dev:7878
+					crowdsec
+		}
+
+		@sonarr host sonarr.housh.dev
+		handle @sonarr {
+					reverse_proxy http://frankenmini.housh.dev:8989
+					crowdsec
+		}
+
+		@lidarr host lidarr.housh.dev
+		handle @lidarr {
+					reverse_proxy http://frankenmini.housh.dev:8686
+					crowdsec
+		}
+
+		@bazarr host bazarr.housh.dev
+		handle @bazarr {
+					reverse_proxy http://frankenmini.housh.dev:6767
+					crowdsec
+		}
+
+		@jellyseerr host jellyseerr.housh.dev
+		handle @jellyseerr {
+					reverse_proxy http://frankenmini.housh.dev:5055
+		}
+
+		@ductcalc host ductcalc.housh.dev
+		handle @ductcalc {
+					reverse_proxy ductcalc:8080
+					crowdsec
+		}
+
 }
+
+
+# Subdomains
+*.mhoush.com {
+    tls {
+        dns cloudflare {env.CF_AUTH_TOKEN}
+        resolvers 1.1.1.1
+    }
+
+    log {
+        level INFO
+        output file /var/log/caddy/access.log
+    }
+
+		@preview host preview.mhoush.com
+		handle @preview {
+					reverse_proxy http://frankenmini.housh.dev:8888
+					crowdsec
+		}
+}
+
+# Console
+console.mightymini.housh.dev {
+    tls {
+        dns cloudflare {env.CF_AUTH_TOKEN}
+        resolvers 1.1.1.1
+    }
+
+    log {
+        level INFO
+        output file /var/log/caddy/access.log
+    }
+
+    reverse_proxy https://192.168.50.6:9090 {
+          transport http {
+              tls_insecure_skip_verify
+          }
+    }
+    crowdsec
+}
+

crowdsec/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+  - /var/log/caddy/*.log
+labels:
+  type: caddy

example.env

@@ -1,3 +1,4 @@
 ACME_EMAIL="acme@example.com"
 CF_AUTH_TOKEN="secret-token"
 CF_EMAIL="cloudflare@example.com"
+CROWDSEC_API_KEY="CHANGEME"