komodo-stacks/projects/caddy/Caddyfile

# Auth HTTP Snippet
(auth_http) {
	@allowed_ips {
		remote_ip 192.168.1.100/32
		remote_ip 10.0.0.0/8
		remote_ip 172.16.0.0/16
	}

	handle @allowed_ips {
		reverse_proxy {args[0]} {
			header_up X-Real-IP {remote_host}
		}
	}

	@auth {
		path /caddy-security/*
	}
	route @auth {
		authenticate with myportal
	}
	route /* {
		authorize with mypolicy
		reverse_proxy {args[0]} {
			header_up X-Real-IP {remote_host}
		}
	}
}

# Auth HTTPS Snippet
(auth_https) {
	@allowed_ips {
		remote_ip 192.168.1.100/32
		remote_ip 10.0.0.0/8
		remote_ip 172.16.0.0/16
	}

	handle @allowed_ips {
		reverse_proxy {args[0]} {
			header_up X-Real-IP {remote_host}
			transport http {
				tls_insecure_skip_verify
			}
		}
	}

	@auth {
		path /caddy-security/*
	}
	route @auth {
		authenticate with myportal
	}
	route /* {
		authorize with mypolicy
		reverse_proxy {args[0]} {
			header_up X-Real-IP {remote_host}
			transport http {
				tls_insecure_skip_verify
			}
		}
	}
}

{
	# Cloudflare DDNS Updater
	dynamic_dns {
		provider cloudflare {env.CLOUDFLARE_API_TOKEN}
		domains {
			{$DOMAIN}
		}
	}
	# Define Trusted Proxy IPs
	servers {
		trusted_proxies cloudflare
	}

	# Global configuration for Pocket-ID
	order authenticate before respond
	order authorize before reverse_proxy

	security {
		oauth identity provider generic {
			delay_start 3
			realm generic
			driver generic
			client_id {env.POCKET_ID_CLIENT_ID}
			client_secret {env.POCKET_ID_CLIENT_SECRET}
			scopes openid email profile
			base_auth_url https://pocketid.{$DOMAIN}
			metadata_url https://pocketid.{$DOMAIN}/.well-known/openid-configuration
		}

		authentication portal myportal {
			crypto default token lifetime 86400 # Seconds until you have to re-authenticate
			enable identity provider generic
			cookie domain {$DOMAIN}
			cookie insecure off
			transform user {
				match realm generic
				action add role user
			}
		}

		authorization policy mypolicy {
			set auth url /caddy-security/oauth2/generic
			allow roles user
			inject headers with claims
		}
	}
}

# Get Wildcard Certificates to avoid leakage of sub domains.
*.{$DOMAIN}, {$DOMAIN} {
	tls {
		dns cloudflare {$CLOUDFLARE_API_TOKEN}
	}

	# Return 404 for the base domain
	@base host {$DOMAIN}
	handle @base {
		respond "Not Found" 404
	}

	# Portainer - HTTPS
	@portainer host portainer.{$DOMAIN}
	handle @portainer {
		import auth_https https://192.168.1.100:9443
	}

	# Grafana
	@grafana host grafana.{$DOMAIN}
	handle @grafana {
		import auth_http 192.168.1.100:3000
	}

	# NGINX Manager
	@nginx host nginx.{$DOMAIN}
	handle @nginx {
		import auth_http 192.168.1.100:81
	}

	# Homer Dashboard
	@homer host homer.{$DOMAIN}
	handle @homer {
		import auth_http 192.168.1.100:8051
	}

	# Prometheus
	@prometheus host prometheus.{$DOMAIN}
	handle @prometheus {
		import auth_http 192.168.1.100:9090
	}

	# Wazuh - HTTPS
	@wazuh host wazuh.{$DOMAIN}
	handle @wazuh {
		import auth_https https://192.168.1.100:8082
	}

	# OpenSearch Dashboard
	@opensearch host opensearch.{$DOMAIN}
	handle @opensearch {
		import auth_http 192.168.1.100:5601
	}

	# TeslaMate
	@teslamate host teslamate.{$DOMAIN}
	handle @teslamate {
		import auth_http 192.168.1.100:3001
	}

	# Pi-hole
	@pihole host pihole.{$DOMAIN}
	handle @pihole {
		import auth_http 192.168.1.100:8053
	}

	# TeslaMate Service
	@teslamateservice host teslamateservice.{$DOMAIN}
	handle @teslamateservice {
		import auth_http 192.168.1.100:4000
	}

	# WordPress
	@wordpress host wordpress.{$DOMAIN}
	handle @wordpress {
		import auth_http 192.168.1.100:32768
	}

	# Router
	@router host router.{$DOMAIN}
	handle @router {
		import auth_http 192.168.1.254:80
	}

	# Investigate Tool
	@investigate host investigate.{$DOMAIN}
	handle @investigate {
		import auth_http 192.168.1.100:7000
	}

	# Epic Games
	@epicgames host epicgames.{$DOMAIN}
	handle @epicgames {
		import auth_http 192.168.1.100:8052
	}

	# n8n
	@n8n host n8n.{$DOMAIN}
	handle @n8n {
		import auth_http 192.168.1.100:5678
	}

	# MISP - HTTPS
	@misp host misp.{$DOMAIN}
	handle @misp {
		import auth_https https://192.168.1.100:4433
	}

	# MinIO with large file upload support
	@minio host minio.{$DOMAIN}
	handle @minio {
		request_body {
			max_size 5GB
		}
		import auth_http 192.168.1.100:9001
	}

	# MinIO API with large file upload support
	@minioapi host minioapi.{$DOMAIN}
	handle @minioapi {
		request_body {
			max_size 5GB
		}
		import auth_http 192.168.1.100:9000
	}

	# OpenSearch API
	@api-opensearch host api-opensearch.{$DOMAIN}
	handle @api-opensearch {
		import auth_http 192.168.1.100:9210
	}

	# Rancher - HTTPS
	@rancher host rancher.{$DOMAIN}
	handle @rancher {
		import auth_https https://192.168.1.100:4438
	}

	# Actual Budget
	@actualbudget host actualbudget.{$DOMAIN}
	handle @actualbudget {
		import auth_http 192.168.1.100:6000
	}

	# Homepage
	@homepage host homepage.{$DOMAIN}
	handle @homepage {
		import auth_http 192.168.1.100:8054
	}

	# 2FA Auth
	@2fauth host 2fauth.{$DOMAIN}
	handle @2fauth {
		import auth_http 192.168.1.100:8085
	}

	# Parcel tracker
	@parcel host parcel.{$DOMAIN}
	handle @parcel {
		import auth_http 192.168.1.100:8086
	}

	# Home Assistant
	@homeassistant host homeassistant.{$DOMAIN}
	handle @homeassistant {
		import auth_http 192.168.1.100:8123
	}

	# HTTPD
	@httpd host httpd.{$DOMAIN}
	handle @httpd {
		import auth_http 192.168.1.100:8085
	}

	# Grocy
	@grocy host grocy.{$DOMAIN}
	handle @grocy {
		import auth_http 192.168.1.100:9283
	}

	# Kibana
	@kibana host kibana.{$DOMAIN}
	handle @kibana {
		import auth_http 192.168.1.100:5601
	}

	# Authentik
	@authentik host authentik.{$DOMAIN}
	handle @authentik {
		reverse_proxy https://192.168.1.100:9533 {
			transport http {
				tls_insecure_skip_verify
			}
		}
	}

	# Zipline
	@zipline host zipline.{$DOMAIN}
	handle @zipline {
		import auth_http 192.168.1.100:3003
	}

	# Code Server
	@codeserver host codeserver.{$DOMAIN}
	handle @codeserver {
		import auth_http 192.168.1.100:8443
	}

	# Uptime Kuma
	@uptime host uptime.{$DOMAIN}
	handle @uptime {
		import auth_http 192.168.1.100:3002
	}

	# CyberChef
	@cyberchef host cyberchef.{$DOMAIN}
	handle @cyberchef {
		import auth_http 192.168.1.100:8001
	}

	# CV
	@cv host cv.{$DOMAIN}
	handle @cv {
		import auth_http 192.168.1.100:8002
	}

	# PDF Tools
	@pdf host pdf.{$DOMAIN}
	handle @pdf {
		import auth_http 192.168.1.100:8055
	}

	# IT Tools
	@it-tools host it-tools.{$DOMAIN}
	handle @it-tools {
		import auth_http 192.168.1.100:8056
	}

	# VW
	@vw host vw.{$DOMAIN}
	handle @vw {
		reverse_proxy 192.168.1.100:3004
	}

	# ConvertX
	@convertx host convertx.{$DOMAIN}
	handle @convertx {
		import auth_http 192.168.1.100:3005
	}

	# Neko
	@neko host neko.{$DOMAIN}
	handle @neko {
		import auth_http 192.168.1.100:3006
	}

	# Resume
	@resume host resume.{$DOMAIN}
	handle @resume {
		import auth_http 192.168.1.100:3007
	}

	# Change Detection
	@changedetection host changedetection.{$DOMAIN}
	handle @changedetection {
		import auth_http 192.168.1.100:3008
	}

	# ReadMe
	@readme host readme.{$DOMAIN}
	handle @readme {
		import auth_http 192.168.1.100:8057
	}

	# Karakeep
	@karakeep host karakeep.{$DOMAIN}
	handle @karakeep {
		reverse_proxy 192.168.1.100:8058
	}

	# Duplicati
	@duplicati host duplicati.{$DOMAIN}
	handle @duplicati {
		import auth_http 192.168.1.100:8200
	}

	# Glance
	@glance host glance.{$DOMAIN}
	handle @glance {
		import auth_http 192.168.1.100:8059
	}

	# Calibre Web Automated
	@cwa host cwa.{$DOMAIN}
	handle @cwa {
		# Allow /kobo/* path without authentication
		@kobo_path {
			path /kobo/*
		}
		handle @kobo_path {
			reverse_proxy 192.168.1.100:8060 {
				# This header is needed to download kepubs from Kobo eReader
				header_up X-Scheme {http.request.scheme}
			}
		}

		# Apply authentication to all other paths
		handle {
			import auth_http 192.168.1.100:8060
		}
	}

	# Cup
	@cup host cup.{$DOMAIN}
	handle @cup {
		import auth_http 192.168.1.100:8061
	}

	# qBitTorrent
	@qbittorrent host qbittorrent.{$DOMAIN}
	handle @qbittorrent {
		import auth_http 192.168.1.100:8063
	}

	# Sonarr
	@sonarr host sonarr.{$DOMAIN}
	handle @sonarr {
		import auth_http 192.168.1.100:8989
	}

	# Radarr
	@radarr host radarr.{$DOMAIN}
	handle @radarr {
		import auth_http 192.168.1.100:7878
	}

	# Prowlarr
	@prowlarr host prowlarr.{$DOMAIN}
	handle @prowlarr {
		import auth_http 192.168.1.100:9696
	}

	# Jellyfin
	@jellyfin host jellyfin.{$DOMAIN}
	handle @jellyfin {
		reverse_proxy 192.168.1.100:8096
	}

	# Jellyseerr
	@jellyseer host jellyseer.{$DOMAIN}
	handle @jellyseer {
		reverse_proxy 192.168.1.100:5056
	}

	# SABnzbd
	@sabnzbd host sabnzbd.{$DOMAIN}
	handle @sabnzbd {
		import auth_http 192.168.1.100:8064
	}

	# Pocket-ID
	@pocketid host pocketid.{$DOMAIN}
	handle @pocketid {
		reverse_proxy 192.168.1.100:8062
	}

	# Komodo
	@komodo host komodo.{$DOMAIN}
	handle @komodo {
		import auth_http 192.168.1.100:9120
	}

	# Gitea
	@gitea host gitea.{$DOMAIN}
	handle @gitea {
		import auth_http 192.168.1.100:8065
	}
}