582 lines
14 KiB
Markdown
582 lines
14 KiB
Markdown
# Caddy
|
|
|
|
## Structure
|
|
|
|
```
|
|
.
|
|
├── caddy (80 | 443)
|
|
└── Caddyfile
|
|
```
|
|
|
|
### Caddy / xcaddy
|
|
|
|
|
|
```bash
|
|
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
|
|
|
|
# caddy
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
|
|
# xcaddy
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-xcaddy.list
|
|
|
|
sudo apt update && sudo apt install -y caddy xcaddy
|
|
```
|
|
|
|
#### Build with dns-ovh
|
|
|
|
```
|
|
https://go.dev/dl/
|
|
```
|
|
|
|
```bash
|
|
wget https://go.dev/dl/go1.23.1.linux-arm64.tar.gz
|
|
rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.23.1.linux-arm64.tar.gz
|
|
export PATH=$PATH:/usr/local/go/bin
|
|
```
|
|
|
|
```bash
|
|
mkdir ~/caddy
|
|
cd caddy
|
|
|
|
xcaddy build --with github.com/caddy-dns/ovh
|
|
sudo mv caddy /usr/bin
|
|
sudo chown root:root /usr/bin/caddy
|
|
sudo chmod 755 /usr/bin/caddy
|
|
sudo systemctl daemon-reload
|
|
```
|
|
|
|
```bash
|
|
sudo vim /etc/caddy/Caddyfile
|
|
```
|
|
|
|
```
|
|
{
|
|
debug
|
|
http_port 80
|
|
https_port 443
|
|
email admin@delmar.bzh
|
|
default_sni delmar.bzh
|
|
|
|
admin :2019
|
|
|
|
acme_dns ovh {
|
|
endpoint ovh-eu
|
|
application_key 3f8bdfed17f848d8
|
|
application_secret 6946758d7515ecef108aeb286bf3c7d0
|
|
consumer_key 94b2ddf482d36421a33aa6b3aa515956
|
|
}
|
|
|
|
log {
|
|
output stderr
|
|
format filter {
|
|
# Preserves first 8 bits from IPv4 and 32 bits from IPv6
|
|
request>remote_ip ip_mask 8 32
|
|
request>client_ip ip_mask 8 32
|
|
|
|
# Remove identificable information
|
|
request>remote_port delete
|
|
request>headers delete
|
|
request>uri query {
|
|
delete url
|
|
delete h
|
|
delete q
|
|
}
|
|
}
|
|
}
|
|
|
|
servers {
|
|
client_ip_headers X-Forwarded-For X-Real-IP
|
|
|
|
# Allow the following IP to passthrough the "X-Forwarded-*" headers to SearXNG
|
|
# https://caddyserver.com/docs/caddyfile/options#trusted-proxies
|
|
trusted_proxies static private_ranges
|
|
trusted_proxies_strict
|
|
}
|
|
}
|
|
|
|
(LAN_only) {
|
|
@local_subnets {
|
|
not remote_ip 192.168.1.0/24
|
|
}
|
|
respond @local_subnets 403
|
|
}
|
|
|
|
*:80 {
|
|
encode zstd gzip
|
|
root * /var/www/comics
|
|
file_server
|
|
}
|
|
|
|
3dm.delmar.bzh {
|
|
reverse_proxy bernie:3214
|
|
encode gzip zstd
|
|
}
|
|
|
|
affine.delmar.bzh {
|
|
reverse_proxy sandy:3010
|
|
encode gzip zstd
|
|
}
|
|
|
|
bookstack.delmar.bzh {
|
|
reverse_proxy sandy:6875
|
|
encode gzip zstd
|
|
}
|
|
|
|
books.delmar.bzh {
|
|
reverse_proxy sandy:32768
|
|
encode gzip zstd
|
|
}
|
|
|
|
cloud.delmar.bzh {
|
|
encode gzip zstd
|
|
reverse_proxy sandy:35771 {
|
|
header_up Host {upstream_hostport}
|
|
}
|
|
|
|
redir /.well-known/carddav /remote.php/dav/ 301
|
|
redir /.well-known/caldav /remote.php/dav/ 301
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"
|
|
X-XSS-Protection "1; mode=block;"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "SAMEORIGIN"
|
|
}
|
|
}
|
|
|
|
cpt.delmar.bzh {
|
|
reverse_proxy bob:9090 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
encode gzip zstd
|
|
}
|
|
|
|
cs.delmar.bzh {
|
|
reverse_proxy sheldon:49505
|
|
encode gzip zstd
|
|
}
|
|
|
|
ctr.delmar.bzh {
|
|
reverse_proxy bob:47810
|
|
encode gzip zstd
|
|
}
|
|
|
|
cvs.delmar.bzh {
|
|
reverse_proxy sandy:54268
|
|
encode gzip zstd
|
|
}
|
|
|
|
dev.delmar.bzh {
|
|
reverse_proxy gary:50154
|
|
encode gzip zstd
|
|
}
|
|
|
|
dkr.delmar.bzh {
|
|
reverse_proxy bob:32519
|
|
encode gzip zstd
|
|
}
|
|
|
|
dolibarr.delmar.bzh {
|
|
reverse_proxy sandy:64616
|
|
encode gzip zstd
|
|
}
|
|
|
|
draw.delmar.bzh {
|
|
reverse_proxy sandy:24928
|
|
encode gzip zstd
|
|
}
|
|
|
|
gen.delmar.bzh {
|
|
reverse_proxy sheldon:63578
|
|
encode gzip zstd
|
|
}
|
|
|
|
git.delmar.bzh {
|
|
reverse_proxy krabs:3001
|
|
encode gzip zstd
|
|
}
|
|
|
|
gotify.delmar.bzh {
|
|
reverse_proxy bob:41901
|
|
encode gzip zstd
|
|
}
|
|
|
|
homepage.delmar.bzh {
|
|
reverse_proxy gary:7575
|
|
encode gzip zstd
|
|
}
|
|
|
|
home-assistant.delmar.bzh {
|
|
reverse_proxy gary:8123
|
|
encode gzip zstd
|
|
}
|
|
|
|
it.delmar.bzh {
|
|
reverse_proxy bob:8888
|
|
encode gzip zstd
|
|
}
|
|
|
|
jellyfin.delmar.bzh {
|
|
reverse_proxy gary:8096
|
|
encode gzip zstd
|
|
}
|
|
|
|
jellyseerr.delmar.bzh {
|
|
reverse_proxy gary:5055
|
|
encode gzip zstd
|
|
}
|
|
|
|
kontadenn.delmar.bzh {
|
|
root * /var/www/kontadenn
|
|
encode gzip zstd
|
|
file_server
|
|
}
|
|
|
|
minio.delmar.bzh {
|
|
reverse_proxy sandy:9000
|
|
encode gzip zstd
|
|
}
|
|
|
|
nds.delmar.bzh {
|
|
root * /var/www/nds
|
|
encode gzip zstd
|
|
file_server
|
|
}
|
|
|
|
nsns.delmar.bzh {
|
|
root * /var/www/nsns
|
|
encode gzip zstd
|
|
file_server
|
|
}
|
|
|
|
octoprint.delmar.bzh {
|
|
reverse_proxy bernie:54963 {
|
|
header_up X-Forwarded-Proto {scheme}
|
|
}
|
|
encode gzip zstd
|
|
}
|
|
|
|
paperless.delmar.bzh {
|
|
reverse_proxy sandy:8000
|
|
encode gzip zstd
|
|
}
|
|
|
|
pdf.delmar.bzh {
|
|
reverse_proxy sandy:9890
|
|
encode gzip zstd
|
|
}
|
|
|
|
penpot.delmar.bzh {
|
|
reverse_proxy sandy:43735
|
|
encode gzip zstd
|
|
}
|
|
|
|
rallly.delmar.bzh {
|
|
reverse_proxy sandy:17818
|
|
encode gzip zstd
|
|
}
|
|
|
|
search.delmar.bzh
|
|
reverse_proxy carlo:23485
|
|
encode gzip zstd
|
|
}
|
|
|
|
send.delmar.bzh {
|
|
reverse_proxy krabs:53842
|
|
encode gzip zstd
|
|
}
|
|
|
|
stream.delmar.bzh {
|
|
reverse_proxy bernie:62036
|
|
encode gzip zstd
|
|
basic_auth / {
|
|
admin $2a$14$RuKvTkZWcLpyX/ptJmkmYOd6WpDACXi.fIcz2feCcvTW73vZ/4TSi
|
|
}
|
|
}
|
|
|
|
tpml.delmar.bzh {
|
|
encode gzip zstd
|
|
root * /var/www/tpml
|
|
file_server
|
|
}
|
|
|
|
twip.delmar.bzh {
|
|
reverse_proxy bob:23473
|
|
encode gzip zstd
|
|
}
|
|
|
|
ugo.delmar.bzh {
|
|
reverse_proxy gary:8090
|
|
encode gzip zstd
|
|
}
|
|
|
|
vault.delmar.bzh {
|
|
reverse_proxy gary:16081
|
|
encode gzip zstd
|
|
}
|
|
|
|
wizarr.delmar.bzh {
|
|
reverse_proxy gary:5690
|
|
encode gzip zstd
|
|
}
|
|
|
|
www.delmar.bzh {
|
|
encode gzip zstd
|
|
|
|
handle {
|
|
root * /var/www/comics
|
|
file_server
|
|
}
|
|
|
|
handle_path /julien/* {
|
|
root * /var/www/resumes/julien
|
|
file_server
|
|
}
|
|
}
|
|
```
|
|
|
|
```bash
|
|
sudo systemctl restart caddy
|
|
```
|
|
|
|
# Services
|
|
|
|
<div class="table-wrapper" id="bkmrk-service-host-ip%3Aport"><table>
|
|
<tbody>
|
|
<tr>
|
|
<th>Service</th>
|
|
<th>Host</th>
|
|
<th>IP:port</th>
|
|
</tr>
|
|
<tr>
|
|
<td>affine.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(affine_server) 3010 </br>
|
|
(affine_migration_job)</br>
|
|
(affine_postgres)</br>
|
|
(affine_redis)</br></td>
|
|
</tr>
|
|
<tr>
|
|
<td>books.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(booklore) 32768 </br>
|
|
(mariadb)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>bookstack.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(bookstack) 6875 </br>
|
|
(bookstack_db)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>cloud.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(nextcloud) 35771 </br>
|
|
(nextcloud-adminer) 62674</br>
|
|
(nextcloud-coturn) 3478 | 5439 | 49160</br>
|
|
(nextcloud-cron) </br>
|
|
(nextcloud-mariadb) </br>
|
|
(nextcloud-redis)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>cpt.delmar.bzh</td>
|
|
<td>All</td>
|
|
<td>() 9090</td>
|
|
</tr>
|
|
<tr>
|
|
<td>cs.delmar.bzh</td>
|
|
<td>sheldon</td>
|
|
<td>(code-server) 49505</td>
|
|
</tr>
|
|
<tr>
|
|
<td>ctr.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>(compose-craft-saas) 47810 </br>
|
|
(compose-craft-db) 27017</td>
|
|
</tr>
|
|
<tr>
|
|
<td>dev.delmar.bzh</td>
|
|
<td>gary</td>
|
|
<td>(appsmith) 50154 </br>
|
|
(pgadmin) </br>
|
|
(postgres)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>dkr.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>(dokemon) 32519</td>
|
|
</tr>
|
|
<tr>
|
|
<td>dolibarr.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(dolibarr_app) 64616 </br>
|
|
(dolibarr_db)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>draw.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>drawio 24928</td>
|
|
</tr>
|
|
<tr>
|
|
<td>gen.delmar.bzh</td>
|
|
<td>sheldon</td>
|
|
<td>(webtrees) 63578</td>
|
|
</tr>
|
|
<tr>
|
|
<td>git.delmar.bzh</td>
|
|
<td>carlo</td>
|
|
<td>192.168.1.163:3001</td>
|
|
</tr>
|
|
<tr>
|
|
<td>gotify.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>(gotify) 41901</td>
|
|
</tr>
|
|
<tr>
|
|
<td>homepage.delmar.bzh</td>
|
|
<td>gary</td>
|
|
<td>(homarr) 7575</td>
|
|
</tr>
|
|
<tr>
|
|
<td>home-assistant.delmar.bzh</td>
|
|
<td>gary</td>
|
|
<td>(homeassistant) 8123</br>
|
|
(mosquitto) 16883 | 19001</td>
|
|
</tr>
|
|
<tr>
|
|
<td>it.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>(it-tools) 8888</td>
|
|
</tr>
|
|
<tr>
|
|
<td>jellyfin.delmar.bzh </br>
|
|
jellyseer.delmar.bzh </br>
|
|
wizarr.delmar.bzh</td>
|
|
<td>gary</td>
|
|
<td>(jellyfin) 8096</br>
|
|
(jellyseerr) 5055</br>
|
|
(wizarr) 5690</br>
|
|
(qbittorrent)</br>
|
|
(sabnzbd)</br>
|
|
(radarr)</br>
|
|
(sonarr)</br>
|
|
(lidarr)</br>
|
|
(prowlarr)</br>
|
|
(bazarr)</br>
|
|
(tdarr)</br>
|
|
(unpackerr)</br>
|
|
(gluetun) >>> VPN</td>
|
|
</tr>
|
|
<tr>
|
|
<td>kontadenn.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>> Caddyfile</td>
|
|
</tr>
|
|
<tr>
|
|
<td>nds.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>> Caddyfile</td>
|
|
</tr>
|
|
<tr>
|
|
<td>nsns.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>> Caddyfile</td>
|
|
</tr>
|
|
<tr>
|
|
<td>octoprint.delmar.bzh </br>
|
|
stream.delmar.bzh</td>
|
|
<td>bernie/td>
|
|
<td>(octoprint) 54963 </br>
|
|
(camera-streamer) 62036</td>
|
|
</tr>
|
|
<tr>
|
|
<td>paperless.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(paperless-ngx) 8000 </br>
|
|
(paperless-postgres) </br>
|
|
(paperless-redis)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>pdf.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(stirling-pdf) 9890</td>
|
|
</tr>
|
|
<tr>
|
|
<td>penpot.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(penpot-frontend) 43735
|
|
(penpot-backend) </br>
|
|
(penpot-exporter) </br>
|
|
(penpot-postgres) </br>
|
|
(penpot-redis)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>*postgres*</td>
|
|
<td>sheldon</td>
|
|
<td>(postgres) 5432 </br>
|
|
(pgadmin) 15432</td>
|
|
</tr>
|
|
<tr>
|
|
<td>rallly.delmar.bzh</td>
|
|
<td>sandy</td>
|
|
<td>(reactive-resume_app) 54268 </br>
|
|
(reactive-resume_minio) 9000 </br>
|
|
(reactive-resume_chrome) </br>
|
|
(reactive-resume_postgres)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>search.delmar.bzh</td>
|
|
<td>carlo</td>
|
|
<td>(searxng) 23485</td>
|
|
</tr>
|
|
<tr>
|
|
<td>send.delmar.bzh</td>
|
|
<td>krabs</td>
|
|
<td>(zipline) 53842</td>
|
|
</tr>
|
|
<tr>
|
|
<td>tpml.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>> Caddyfile</td>
|
|
</tr>
|
|
<tr>
|
|
<td>twip.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>(twip) 23473</td>
|
|
</tr>
|
|
<tr>
|
|
<td>ugo.delmar.bzh</td>
|
|
<td>gary</td>
|
|
<td>(wordpress-app) 8090 </br>
|
|
(wordpress-adminer) 62674 </br>
|
|
(wordpress-mariadb)</td>
|
|
</tr>
|
|
<tr>
|
|
<td>vault.delmar.bzh</td>
|
|
<td>gary</td>
|
|
<td>(vaultwarden) 3012 | 16081</td>
|
|
</tr>
|
|
<tr>
|
|
<td>www.delmar.bzh</td>
|
|
<td>bob</td>
|
|
<td>> Caddyfile</td>
|
|
</tr>
|
|
<tr>
|
|
<td>...</td>
|
|
<td>All</td>
|
|
<td>watchtower</td>
|
|
</tr>
|
|
<tr>
|
|
<td> </td>
|
|
<td> </td>
|
|
<td> </td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
</div>
|