feat: Updates Caddyfile for franken-mini services

.gitea/workflows/ci.yaml

@@ -1,55 +0,0 @@
-# name: CI
-#
-# on:
-#   push:
-#     branches:
-#       - main
-#   pull_request: {}
-#   workflow_dispatch: {}
-#
-# jobs:
-#   release:
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Checkout
-#         uses: actions/checkout@v4
-#         with:
-#           lfs: true
-#
-#       - name: Setup QEMU
-#         uses: docker/setup-qemu-action@v3
-#
-#       - name: Setup docker buildx
-#         uses: docker/setup-buildx-action@v3
-#
-#       - name: Login to Container Registery
-#         uses: docker/login-action@v3
-#         with:
-#           registry: git.housh.dev
-#           username: ${{ secrets.DOCKER_USERNAME }}
-#           password: ${{ secrets.DOCKER_PASSWORD }}
-#
-#       - name: Extract metadata for Docker
-#         id: meta
-#         uses: docker/metadata-action@v5
-#         with:
-#           images: git.housh.dev/homelab/caddy
-#           tags: |
-#             type=schedule
-#             type=ref,event=branch
-#             type=ref,event=pr
-#             type=semver,pattern={{version}}
-#             type=semver,pattern={{major}}.{{minor}}
-#             type=semver,pattern={{major}}
-#             type=sha
-#             type=raw,value=latest
-#
-#       - name: Build and push Docker image
-#         uses: docker/build-push-action@v6
-#         with:
-#           context: .
-#           file: ./Dockerfile
-#           platforms: linux/arm64
-#           push: true
-#           tags: ${{ steps.meta.outputs.tags }}
-#           labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -1 +0,0 @@
-.env

Dockerfile

@@ -1,23 +1,7 @@
-# Adapted from: https://github.com/crowdsecurity/example-docker-compose/blob/main/caddy/Caddyfile
+FROM docker.io/library/caddy:2.9.1-builder as builder
-#
-# the different stages of this Dockerfile are meant to be built into separate images
-# https://docs.docker.com/develop/develop-images/multistage-build/#stop-at-a-specific-build-stage
-# https://docs.docker.com/compose/compose-file/#target
-
-# https://docs.docker.com/engine/reference/builder/#understand-how-arg-and-from-interact
-ARG CADDY_VERSION=2
-
-FROM caddy:${CADDY_VERSION}-builder-alpine AS builder
 
 RUN xcaddy build \
-  --with github.com/caddy-dns/cloudflare \
+  --with github.com/caddy-dns/cloudflare
-  --with github.com/mholt/caddy-l4 \
-  --with github.com/caddyserver/transform-encoder \
-  --with github.com/hslatman/caddy-crowdsec-bouncer/http@main \
-  --with github.com/hslatman/caddy-crowdsec-bouncer/layer4@main
-
-FROM caddy:${CADDY_VERSION} AS caddy
-
-WORKDIR /
 
+FROM docker.io/library/caddy:2.9.1-alpine
 COPY --from=builder /usr/bin/caddy /usr/bin/caddy

README.md

@@ -1,18 +1,3 @@
 # caddy
 
-Caddy reverse proxy, [caddy](https://caddyserver.com/docs/quick-starts/reverse-proxy)
+Caddy reverse proxy.
-
-This repository includes the reverse-proxy for the domain's hosted under `*.housh.dev`. The primary
-proxy is on the `main` branch, there are also proxies that run on each server, that can be found on
-the other branches of this repository.
-
-This allows TLS to all backend services from the `primary` proxy.
-
-They all share the same `Dockerfile` and `compose.yaml` file, the only differences are the
-`config/Caddyfile`.
-
-## Usage
-
-1. Clone the repository onto your host, or setup through your container manager (such as komodo).
-2. Copy the `example.env` file to `.env` and update the environment variables.
-3. Deploy the proxy `sudo docker compose --env-file .env up -d`

compose.yaml

@@ -2,7 +2,7 @@ services:
   caddy:
     build:
       context: .
-      target: caddy
+      dockerfile: Dockerfile
     container_name: caddy
     restart: unless-stopped
     env_file:
@@ -11,7 +11,6 @@ services:
       - CLOUDFLARE_EMAIL=${CF_EMAIL}
       - CLOUDFLARE_API_TOKEN=${CF_AUTH_TOKEN}
       - ACME_AGREE=true
-      - CROWDSEC_API_KEY=${CROWDSEC_API_KEY}
     ports:
       - 80:80
       - 443:443
@@ -19,39 +18,17 @@ services:
     cap_add:
       - NET_ADMIN
     volumes:
-      - ./config:/etc/caddy
+      - ./config:/etc/caddy:z
       - caddy_data:/data
       - caddy_config:/config
-      - caddy_logs:/var/log/caddy
     networks:
       - proxy
     security_opt:
       - no-new-privileges:true
 
-  crowdsec:
-    image: docker.io/crowdsecurity/crowdsec:latest
-    container_name: crowdsec
-    restart: unless-stopped
-    environment:
-      - GID=1000
-      - COLLECTIONS=crowdsecurity/linux crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
-      - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
-    volumes:
-      - crowdsec_db:/var/lib/crowdsec/data/
-      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
-      - caddy_logs:/var/log/caddy:ro
-    networks:
-      - proxy
-    security_opt:
-      - no-new-privileges:true
-    depends_on:
-      - caddy
-
 volumes:
   caddy_data: {}
   caddy_config: {}
-  caddy_logs: {}
-  crowdsec_db: {}
 
 networks:
   proxy:

config/Caddyfile

@@ -1,236 +1,16 @@
 {
     email {env.ACME_EMAIL}
-    servers {
-        client_ip_headers X-Forwarded-For
-        trusted_proxies static private_ranges
-        trusted_proxies_strict
-    }
-    order crowdsec before respond
-    crowdsec {
-          api_url http://crowdsec:8080
-          api_key {$CROWDSEC_API_KEY}
-    }
 }
 
-# Subdomains
+*.frankenmini.housh.dev {
-*.housh.dev {
     tls {
         dns cloudflare {env.CF_AUTH_TOKEN}
         resolvers 1.1.1.1
     }
 
-    log {
+   @immich host photos.frankenmini.housh.dev
-        level INFO
-        output file /var/log/caddy/access.log
-    }
-
-    @pos host po.housh.dev
-    handle @pos {
-          reverse_proxy http://roguemini.housh.dev:8082
-          crowdsec
-    }
-
-    @legacypos host legacy-po.housh.dev
-    handle @legacypos {
-         reverse_proxy http://roguemini.housh.dev:5000
-          crowdsec
-    }
-
-    @gitea host git.housh.dev
-    handle @gitea {
-         reverse_proxy gitea:3000
-          crowdsec
-    }
-
-    @dash host dash.housh.dev
-    handle @dash {
-         reverse_proxy http://roguemini.housh.dev:7575
-          crowdsec
-    }
-
-    @komodo host komo.housh.dev
-    handle @komodo {
-         reverse_proxy komodo:9120
-          crowdsec
-    }
-
-    @excalidraw host draw.housh.dev
-    handle @excalidraw {
-         reverse_proxy excalidraw:80
-          crowdsec
-    }
-
-    @uptimekuma host uptime.housh.dev
-    handle @uptimekuma {
-          reverse_proxy uptime_kuma:3001
-          crowdsec
-    }
-
-    @immich host photos.housh.dev
     handle @immich {
-
+          reverse_proxy immich-server:2283
-      # Immich public proxy.
-      @public path /share /share/*
-      handle @public {
-          reverse_proxy http://frankenmini.housh.dev:3000
-          crowdsec
-      }
-
-      handle {
-          reverse_proxy http://frankenmini.housh.dev:2283
-          crowdsec
-      }
-    }
-
-    @snapp host s.housh.dev
-    handle @snapp {
-          reverse_proxy http://roguemini.housh.dev:3000
-          crowdsec
-    }
-
-    @docs host docs.housh.dev
-    handle @docs {
-          reverse_proxy docs:80
-          crowdsec
-    }
-
-    @pocket_id host id.housh.dev
-    handle @pocket_id {
-          reverse_proxy pocket-id:1411
-          crowdsec
-    }
-
-    @plausible host plausible.housh.dev
-    handle @plausible {
-          reverse_proxy http://roguemini.housh.dev:8004
-          crowdsec
-    }
-
-    @vaultwarden host vaultwarden.housh.dev
-    handle @vaultwarden {
-          reverse_proxy http://roguemini.housh.dev:8888
-          crowdsec
-    }
-
-    @calendar host calendar.housh.dev
-    handle @calendar {
-          reverse_proxy http://frankenmini.housh.dev:5232
-          crowdsec
-    }
-
-    @ollama host ollama.housh.dev
-    handle @ollama {
-          reverse_proxy http://roguemini.housh.dev:3001
-          crowdsec
-    }
-
-		@shlink host l.housh.dev
-		handle @shlink {
-					reverse_proxy http://roguemini.housh.dev:8880
-					crowdsec
-		}
-
-		@shlink_web host shlink.housh.dev
-		handle @shlink_web {
-					reverse_proxy http://roguemini.housh.dev:8881
-					crowdsec
-		}
-
-		######################################################
-		#  Media / *arr stack
-		######################################################
-		@jellyfin host jellyfin.housh.dev
-		handle @jellyfin {
-					reverse_proxy http://frankenmini.housh.dev:8096
-					crowdsec
-		}
-
-		@qbittorrent host qbittorrent.housh.dev
-		handle @qbittorrent {
-					reverse_proxy http://frankenmini.housh.dev:8701
-					crowdsec
-		}
-
-		@prowlarr host prowlarr.housh.dev
-		handle @prowlarr {
-					reverse_proxy http://frankenmini.housh.dev:9696
-					crowdsec
-		}
-
-		@radarr host radarr.housh.dev
-		handle @radarr {
-					reverse_proxy http://frankenmini.housh.dev:7878
-					crowdsec
-		}
-
-		@sonarr host sonarr.housh.dev
-		handle @sonarr {
-					reverse_proxy http://frankenmini.housh.dev:8989
-					crowdsec
-		}
-
-		@lidarr host lidarr.housh.dev
-		handle @lidarr {
-					reverse_proxy http://frankenmini.housh.dev:8686
-					crowdsec
-		}
-
-		@bazarr host bazarr.housh.dev
-		handle @bazarr {
-					reverse_proxy http://frankenmini.housh.dev:6767
-					crowdsec
-		}
-
-		@jellyseerr host jellyseerr.housh.dev
-		handle @jellyseerr {
-					reverse_proxy http://frankenmini.housh.dev:5055
-		}
-
-		@ductcalc host ductcalc.housh.dev
-		handle @ductcalc {
-					reverse_proxy ductcalc:8080
-					crowdsec
     }
 
 }
-
-
-# Subdomains
-*.mhoush.com {
-    tls {
-        dns cloudflare {env.CF_AUTH_TOKEN}
-        resolvers 1.1.1.1
-    }
-
-    log {
-        level INFO
-        output file /var/log/caddy/access.log
-    }
-
-		@preview host preview.mhoush.com
-		handle @preview {
-					reverse_proxy http://frankenmini.housh.dev:8888
-					crowdsec
-		}
-}
-
-# Console
-console.mightymini.housh.dev {
-    tls {
-        dns cloudflare {env.CF_AUTH_TOKEN}
-        resolvers 1.1.1.1
-    }
-
-    log {
-        level INFO
-        output file /var/log/caddy/access.log
-    }
-
-    reverse_proxy https://192.168.50.6:9090 {
-          transport http {
-              tls_insecure_skip_verify
-          }
-    }
-    crowdsec
-}
-

crowdsec/acquis.yaml

@@ -1,4 +0,0 @@
-filenames:
-  - /var/log/caddy/*.log
-labels:
-  type: caddy

example.env

@@ -1,4 +1,3 @@
 ACME_EMAIL="acme@example.com"
 CF_AUTH_TOKEN="secret-token"
 CF_EMAIL="cloudflare@example.com"
-CROWDSEC_API_KEY="CHANGEME"