Sync caddy from Gitea to monorepo

Repository: admin/caddy Timestamp: 2025-04-24_21-59-09 Target directory: projects/caddy
2026-11-11 02:00:06 +01:00 · 2025-04-24 21:59:10 +01:00
1 parent f902bfdf71
commit f6b7fd7852
@@ -108,381 +108,337 @@
 	}
 }

-# Get Wildcard Certificates to avoid leakage of sub domains.
-*.{$DOMAIN}, {$DOMAIN} {
+# Wildcard certificate configuration
+*.{$DOMAIN} {
 	tls {
 		dns cloudflare {$CLOUDFLARE_API_TOKEN}
 	}
+	abort
+}

-	# Return 404 for the base domain
-	@base host {$DOMAIN}
-	handle @base {
-		respond "Not Found" 404
+# Base domain configuration
+{$DOMAIN} {
+	tls {
+		dns cloudflare {$CLOUDFLARE_API_TOKEN}
 	}
+	respond "Not Found" 404
+}

-	# Portainer - HTTPS
-	@portainer host portainer.{$DOMAIN}
-	handle @portainer {
-		import auth_https https://192.168.1.100:9443
+# Portainer - HTTPS
+portainer.{$DOMAIN} {
+	import auth_https https://192.168.1.100:9443
+}
+
+# Grafana
+grafana.{$DOMAIN} {
+	import auth_http 192.168.1.100:3000
+}
+
+# NGINX Manager
+nginx.{$DOMAIN} {
+	import auth_http 192.168.1.100:81
+}
+
+# Homer Dashboard
+homer.{$DOMAIN} {
+	import auth_http 192.168.1.100:8051
+}
+
+# Prometheus
+prometheus.{$DOMAIN} {
+	import auth_http 192.168.1.100:9090
+}
+
+# Wazuh - HTTPS
+wazuh.{$DOMAIN} {
+	import auth_https https://192.168.1.100:8082
+}
+
+# OpenSearch Dashboard
+opensearch.{$DOMAIN} {
+	import auth_http 192.168.1.100:5601
+}
+
+# TeslaMate
+teslamate.{$DOMAIN} {
+	import auth_http 192.168.1.100:3001
+}
+
+# Pi-hole
+pihole.{$DOMAIN} {
+	import auth_http 192.168.1.100:8053
+}
+
+# TeslaMate Service
+teslamateservice.{$DOMAIN} {
+	import auth_http 192.168.1.100:4000
+}
+
+# WordPress
+wordpress.{$DOMAIN} {
+	import auth_http 192.168.1.100:32768
+}
+
+# Router
+router.{$DOMAIN} {
+	import auth_http 192.168.1.254:80
+}
+
+# Investigate Tool
+investigate.{$DOMAIN} {
+	import auth_http 192.168.1.100:7000
+}
+
+# Epic Games
+epicgames.{$DOMAIN} {
+	import auth_http 192.168.1.100:8052
+}
+
+# n8n
+n8n.{$DOMAIN} {
+	import auth_http 192.168.1.100:5678
+}
+
+# MISP - HTTPS
+misp.{$DOMAIN} {
+	import auth_https https://192.168.1.100:4433
+}
+
+# MinIO with large file upload support
+minio.{$DOMAIN} {
+	request_body {
+		max_size 5GB
 	}
+	import auth_http 192.168.1.100:9001
+}

-	# Grafana
-	@grafana host grafana.{$DOMAIN}
-	handle @grafana {
-		import auth_http 192.168.1.100:3000
+# MinIO API with large file upload support
+minioapi.{$DOMAIN} {
+	request_body {
+		max_size 5GB
 	}
+	import auth_http 192.168.1.100:9000
+}

-	# NGINX Manager
-	@nginx host nginx.{$DOMAIN}
-	handle @nginx {
-		import auth_http 192.168.1.100:81
-	}
+# OpenSearch API
+api-opensearch.{$DOMAIN} {
+	import auth_http 192.168.1.100:9210
+}

-	# Homer Dashboard
-	@homer host homer.{$DOMAIN}
-	handle @homer {
-		import auth_http 192.168.1.100:8051
-	}
+# Rancher - HTTPS
+rancher.{$DOMAIN} {
+	import auth_https https://192.168.1.100:4438
+}

-	# Prometheus
-	@prometheus host prometheus.{$DOMAIN}
-	handle @prometheus {
-		import auth_http 192.168.1.100:9090
-	}
+# Actual Budget
+actualbudget.{$DOMAIN} {
+	import auth_http 192.168.1.100:6000
+}

-	# Wazuh - HTTPS
-	@wazuh host wazuh.{$DOMAIN}
-	handle @wazuh {
-		import auth_https https://192.168.1.100:8082
-	}
+# Homepage
+homepage.{$DOMAIN} {
+	import auth_http 192.168.1.100:8054
+}

-	# OpenSearch Dashboard
-	@opensearch host opensearch.{$DOMAIN}
-	handle @opensearch {
-		import auth_http 192.168.1.100:5601
-	}
+# 2FA Auth
+2fauth.{$DOMAIN} {
+	import auth_http 192.168.1.100:8085
+}

-	# TeslaMate
-	@teslamate host teslamate.{$DOMAIN}
-	handle @teslamate {
-		import auth_http 192.168.1.100:3001
-	}
+# Parcel tracker
+parcel.{$DOMAIN} {
+	import auth_http 192.168.1.100:8086
+}

-	# Pi-hole
-	@pihole host pihole.{$DOMAIN}
-	handle @pihole {
-		import auth_http 192.168.1.100:8053
-	}
+# Home Assistant
+homeassistant.{$DOMAIN} {
+	import auth_http 192.168.1.100:8123
+}

-	# TeslaMate Service
-	@teslamateservice host teslamateservice.{$DOMAIN}
-	handle @teslamateservice {
-		import auth_http 192.168.1.100:4000
-	}
+# HTTPD
+httpd.{$DOMAIN} {
+	import auth_http 192.168.1.100:8085
+}

-	# WordPress
-	@wordpress host wordpress.{$DOMAIN}
-	handle @wordpress {
-		import auth_http 192.168.1.100:32768
-	}
+# Grocy
+grocy.{$DOMAIN} {
+	import auth_http 192.168.1.100:9283
+}

-	# Router
-	@router host router.{$DOMAIN}
-	handle @router {
-		import auth_http 192.168.1.254:80
-	}
+# Kibana
+kibana.{$DOMAIN} {
+	import auth_http 192.168.1.100:5601
+}

-	# Investigate Tool
-	@investigate host investigate.{$DOMAIN}
-	handle @investigate {
-		import auth_http 192.168.1.100:7000
-	}
-
-	# Epic Games
-	@epicgames host epicgames.{$DOMAIN}
-	handle @epicgames {
-		import auth_http 192.168.1.100:8052
-	}
-
-	# n8n
-	@n8n host n8n.{$DOMAIN}
-	handle @n8n {
-		import auth_http 192.168.1.100:5678
-	}
-
-	# MISP - HTTPS
-	@misp host misp.{$DOMAIN}
-	handle @misp {
-		import auth_https https://192.168.1.100:4433
-	}
-
-	# MinIO with large file upload support
-	@minio host minio.{$DOMAIN}
-	handle @minio {
-		request_body {
-			max_size 5GB
+# Authentik
+authentik.{$DOMAIN} {
+	reverse_proxy https://192.168.1.100:9533 {
+		transport http {
+			tls_insecure_skip_verify
 		}
-		import auth_http 192.168.1.100:9001
-	}
-
-	# MinIO API with large file upload support
-	@minioapi host minioapi.{$DOMAIN}
-	handle @minioapi {
-		request_body {
-			max_size 5GB
-		}
-		import auth_http 192.168.1.100:9000
-	}
-
-	# OpenSearch API
-	@api-opensearch host api-opensearch.{$DOMAIN}
-	handle @api-opensearch {
-		import auth_http 192.168.1.100:9210
-	}
-
-	# Rancher - HTTPS
-	@rancher host rancher.{$DOMAIN}
-	handle @rancher {
-		import auth_https https://192.168.1.100:4438
-	}
-
-	# Actual Budget
-	@actualbudget host actualbudget.{$DOMAIN}
-	handle @actualbudget {
-		import auth_http 192.168.1.100:6000
-	}
-
-	# Homepage
-	@homepage host homepage.{$DOMAIN}
-	handle @homepage {
-		import auth_http 192.168.1.100:8054
-	}
-
-	# 2FA Auth
-	@2fauth host 2fauth.{$DOMAIN}
-	handle @2fauth {
-		import auth_http 192.168.1.100:8085
-	}
-
-	# Parcel tracker
-	@parcel host parcel.{$DOMAIN}
-	handle @parcel {
-		import auth_http 192.168.1.100:8086
-	}
-
-	# Home Assistant
-	@homeassistant host homeassistant.{$DOMAIN}
-	handle @homeassistant {
-		import auth_http 192.168.1.100:8123
-	}
-
-	# HTTPD
-	@httpd host httpd.{$DOMAIN}
-	handle @httpd {
-		import auth_http 192.168.1.100:8085
-	}
-
-	# Grocy
-	@grocy host grocy.{$DOMAIN}
-	handle @grocy {
-		import auth_http 192.168.1.100:9283
-	}
-
-	# Kibana
-	@kibana host kibana.{$DOMAIN}
-	handle @kibana {
-		import auth_http 192.168.1.100:5601
-	}
-
-	# Authentik
-	@authentik host authentik.{$DOMAIN}
-	handle @authentik {
-		reverse_proxy https://192.168.1.100:9533 {
-			transport http {
-				tls_insecure_skip_verify
-			}
-		}
-	}
-
-	# Zipline
-	@zipline host zipline.{$DOMAIN}
-	handle @zipline {
-		import auth_http 192.168.1.100:3003
-	}
-
-	# Code Server
-	@codeserver host codeserver.{$DOMAIN}
-	handle @codeserver {
-		import auth_http 192.168.1.100:8443
-	}
-
-	# Uptime Kuma
-	@uptime host uptime.{$DOMAIN}
-	handle @uptime {
-		import auth_http 192.168.1.100:3002
-	}
-
-	# CyberChef
-	@cyberchef host cyberchef.{$DOMAIN}
-	handle @cyberchef {
-		import auth_http 192.168.1.100:8001
-	}
-
-	# CV
-	@cv host cv.{$DOMAIN}
-	handle @cv {
-		import auth_http 192.168.1.100:8002
-	}
-
-	# PDF Tools
-	@pdf host pdf.{$DOMAIN}
-	handle @pdf {
-		import auth_http 192.168.1.100:8055
-	}
-
-	# IT Tools
-	@it-tools host it-tools.{$DOMAIN}
-	handle @it-tools {
-		import auth_http 192.168.1.100:8056
-	}
-
-	# VW
-	@vw host vw.{$DOMAIN}
-	handle @vw {
-		reverse_proxy 192.168.1.100:3004
-	}
-
-	# ConvertX
-	@convertx host convertx.{$DOMAIN}
-	handle @convertx {
-		import auth_http 192.168.1.100:3005
-	}
-
-	# Neko
-	@neko host neko.{$DOMAIN}
-	handle @neko {
-		import auth_http 192.168.1.100:3006
-	}
-
-	# Resume
-	@resume host resume.{$DOMAIN}
-	handle @resume {
-		import auth_http 192.168.1.100:3007
-	}
-
-	# Change Detection
-	@changedetection host changedetection.{$DOMAIN}
-	handle @changedetection {
-		import auth_http 192.168.1.100:3008
-	}
-
-	# ReadMe
-	@readme host readme.{$DOMAIN}
-	handle @readme {
-		import auth_http 192.168.1.100:8057
-	}
-
-	# Karakeep
-	@karakeep host karakeep.{$DOMAIN}
-	handle @karakeep {
-		reverse_proxy 192.168.1.100:8058
-	}
-
-	# Duplicati
-	@duplicati host duplicati.{$DOMAIN}
-	handle @duplicati {
-		import auth_http 192.168.1.100:8200
-	}
-
-	# Glance
-	@glance host glance.{$DOMAIN}
-	handle @glance {
-		import auth_http 192.168.1.100:8059
-	}
-
-	# Calibre Web Automated
-	@cwa host cwa.{$DOMAIN}
-	handle @cwa {
-		# Allow /kobo/* path without authentication
-		@kobo_path {
-			path /kobo/*
-		}
-		handle @kobo_path {
-			reverse_proxy 192.168.1.100:8060 {
-				# This header is needed to download kepubs from Kobo eReader
-				header_up X-Scheme {http.request.scheme}
-			}
-		}
-
-		# Apply authentication to all other paths
-		handle {
-			import auth_http 192.168.1.100:8060
-		}
-	}
-
-	# Cup
-	@cup host cup.{$DOMAIN}
-	handle @cup {
-		import auth_http 192.168.1.100:8061
-	}
-
-	# qBitTorrent
-	@qbittorrent host qbittorrent.{$DOMAIN}
-	handle @qbittorrent {
-		import auth_http 192.168.1.100:8063
-	}
-
-	# Sonarr
-	@sonarr host sonarr.{$DOMAIN}
-	handle @sonarr {
-		import auth_http 192.168.1.100:8989
-	}
-
-	# Radarr
-	@radarr host radarr.{$DOMAIN}
-	handle @radarr {
-		import auth_http 192.168.1.100:7878
-	}
-
-	# Prowlarr
-	@prowlarr host prowlarr.{$DOMAIN}
-	handle @prowlarr {
-		import auth_http 192.168.1.100:9696
-	}
-
-	# Jellyfin
-	@jellyfin host jellyfin.{$DOMAIN}
-	handle @jellyfin {
-		reverse_proxy 192.168.1.100:8096
-	}
-
-	# Jellyseerr
-	@jellyseer host jellyseer.{$DOMAIN}
-	handle @jellyseer {
-		reverse_proxy 192.168.1.100:5056
-	}
-
-	# SABnzbd
-	@sabnzbd host sabnzbd.{$DOMAIN}
-	handle @sabnzbd {
-		import auth_http 192.168.1.100:8064
-	}
-
-	# Pocket-ID
-	@pocketid host pocketid.{$DOMAIN}
-	handle @pocketid {
-		reverse_proxy 192.168.1.100:8062
-	}
-
-	# Komodo
-	@komodo host komodo.{$DOMAIN}
-	handle @komodo {
-		import auth_http 192.168.1.100:9120
-	}
-
-	# Gitea
-	@gitea host gitea.{$DOMAIN}
-	handle @gitea {
-		import auth_http 192.168.1.100:8065
 	}
 }
+
+# Zipline
+zipline.{$DOMAIN} {
+	import auth_http 192.168.1.100:3003
+}
+
+# Code Server
+codeserver.{$DOMAIN} {
+	import auth_http 192.168.1.100:8443
+}
+
+# Uptime Kuma
+uptime.{$DOMAIN} {
+	import auth_http 192.168.1.100:3002
+}
+
+# CyberChef
+cyberchef.{$DOMAIN} {
+	import auth_http 192.168.1.100:8001
+}
+
+# CV
+cv.{$DOMAIN} {
+	import auth_http 192.168.1.100:8002
+}
+
+# PDF Tools
+pdf.{$DOMAIN} {
+	import auth_http 192.168.1.100:8055
+}
+
+# IT Tools
+it-tools.{$DOMAIN} {
+	import auth_http 192.168.1.100:8056
+}
+
+# VW
+vw.{$DOMAIN} {
+	reverse_proxy 192.168.1.100:3004
+}
+
+# ConvertX
+convertx.{$DOMAIN} {
+	import auth_http 192.168.1.100:3005
+}
+
+# Neko
+neko.{$DOMAIN} {
+	import auth_http 192.168.1.100:3006
+}
+
+# Resume
+resume.{$DOMAIN} {
+	import auth_http 192.168.1.100:3007
+}
+
+# Change Detection
+changedetection.{$DOMAIN} {
+	import auth_http 192.168.1.100:3008
+}
+
+# ReadMe
+readme.{$DOMAIN} {
+	import auth_http 192.168.1.100:8057
+}
+
+# Karakeep
+karakeep.{$DOMAIN} {
+	reverse_proxy 192.168.1.100:8058
+}
+
+# Duplicati
+duplicati.{$DOMAIN} {
+	import auth_http 192.168.1.100:8200
+}
+
+# Glance
+glance.{$DOMAIN} {
+	import auth_http 192.168.1.100:8059
+}
+
+# Calibre Web Automated
+cwa.{$DOMAIN} {
+	# Allow /kobo/* path without authentication
+	@kobo_path {
+		path /kobo/*
+	}
+	handle @kobo_path {
+		reverse_proxy 192.168.1.100:8060 {
+			# This header is needed to download kepubs from Kobo eReader
+			header_up X-Scheme {http.request.scheme}
+		}
+	}
+
+	# Apply authentication to all other paths
+	handle {
+		import auth_http 192.168.1.100:8060
+	}
+}
+
+# Cup
+cup.{$DOMAIN} {
+	import auth_http 192.168.1.100:8061
+}
+
+# qBitTorrent
+qbittorrent.{$DOMAIN} {
+	import auth_http 192.168.1.100:8063
+}
+
+# Sonarr
+sonarr.{$DOMAIN} {
+	import auth_http 192.168.1.100:8989
+}
+
+# Radarr
+radarr.{$DOMAIN} {
+	import auth_http 192.168.1.100:7878
+}
+
+# Prowlarr
+prowlarr.{$DOMAIN} {
+	import auth_http 192.168.1.100:9696
+}
+
+# Jellyfin
+jellyfin.{$DOMAIN} {
+	reverse_proxy 192.168.1.100:8096
+}
+
+# Jellyseerr
+jellyseerr.{$DOMAIN} {
+	reverse_proxy 192.168.1.100:5056
+}
+
+# SABnzbd
+sabnzbd.{$DOMAIN} {
+	import auth_http 192.168.1.100:8064
+}
+
+# Pocket-ID
+pocketid.{$DOMAIN} {
+	reverse_proxy 192.168.1.100:8062
+}
+
+# Komodo
+komodo.{$DOMAIN} {
+	import auth_http 192.168.1.100:9120
+}
+
+# Gitea
+gitea.{$DOMAIN} {
+	import auth_http 192.168.1.100:8065
+}
+
+# giteasync
+giteasync.{$DOMAIN} {
+	import auth_http 192.168.1.100:8066
+}
+
+# FreshRSS
+freshrss.{$DOMAIN} {
+	import auth_http 192.168.1.100:8067
+}
@@ -1,6 +1,6 @@
 services:
  caddy:
-    image: serfriz/caddy-cloudflare-ddns-security:latest
+    image: serfriz/caddy-cloudflare-ddns-crowdsec-geoip-security:latest
    container_name: caddy
    restart: unless-stopped
    command: ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--watch"]
@@ -13,10 +13,14 @@ services:
      DOMAIN: ${DOMAIN}
      POCKET_ID_CLIENT_ID: ${POCKET_ID_CLIENT_ID}
      POCKET_ID_CLIENT_SECRET: ${POCKET_ID_CLIENT_SECRET}
+      CROWDSEC_API_KEY: "${CROWDSEC_API_KEY}"
    volumes:
      - ./caddy:/etc/caddy
      - ./data:/data
      - ./config:/config
+      - ./logs:/var/log/caddy
+#    depends_on:
+#      - crowdsec

  cloudflared:
    image: cloudflare/cloudflared:latest
@@ -26,4 +30,22 @@ services:
    volumes:
      - ./cloudflared:/etc/cloudflared
    depends_on:
-      - caddy
+      - caddy
+
+  crowdsec:
+    image: docker.io/crowdsecurity/crowdsec:latest
+    container_name: crowdsec
+    environment:
+      - GID=1000
+      - COLLECTIONS=crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
+      - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
+    volumes:
+      - crowdsec-db:/var/lib/crowdsec/data/
+      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
+      - ./logs:/var/log/caddy:ro
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges=true
+
+volumes:
+  crowdsec-db: