bk node and refactor
This commit is contained in:
@@ -19,9 +19,9 @@ Image={{ domain['internal'] }}/{{ node['name'] }}/caddy:{{ version['containers']
|
||||
ContainerName=caddy_{{ node['name'] }}
|
||||
HostName=caddy_{{ node['name'] }}
|
||||
{% if node['name'] == 'infra' %}
|
||||
AddHost={{ services['ca']['domain'] }}.{{ domain['internal'] }}:host-gateway
|
||||
AddHost={{ services['prometheus']['domain'] }}.{{ domain['internal'] }}:host-gateway
|
||||
AddHost={{ services['loki']['domain'] }}.{{ domain['internal'] }}:host-gateway
|
||||
AddHost={{ services['ca']['domain']['internal'] }}.{{ domain['internal'] }}:host-gateway
|
||||
AddHost={{ services['prometheus']['domain']['internal'] }}.{{ domain['internal'] }}:host-gateway
|
||||
AddHost={{ services['loki']['domain']['internal'] }}.{{ domain['internal'] }}:host-gateway
|
||||
{% endif %}
|
||||
|
||||
PublishPort={{ services['caddy']['ports']['http'] }}:80/tcp
|
||||
|
||||
@@ -0,0 +1,92 @@
|
||||
{% if node['name'] == 'auth' %}
|
||||
{
|
||||
# CrowdSec LAPI connection
|
||||
crowdsec {
|
||||
api_url https://{{ services['crowdsec']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}
|
||||
api_key "{file./run/secrets/CADDY_CROWDSEC_KEY}"
|
||||
}
|
||||
}
|
||||
|
||||
# Snippets
|
||||
# CrowdSec log for parser
|
||||
(crowdsec_log) {
|
||||
log {
|
||||
output file /log/access.log {
|
||||
mode 0644
|
||||
roll_size 100MiB
|
||||
roll_keep 1
|
||||
}
|
||||
format json
|
||||
}
|
||||
}
|
||||
{% endif %}
|
||||
{% if node['name'] == 'app' %}
|
||||
{
|
||||
servers {
|
||||
# Only accept packets from auth main caddy
|
||||
trusted_proxies static {{ hostvars['fw']['network4']['auth']['server'] }} {{ hostvars['fw']['network6']['auth']['server'] }}
|
||||
}
|
||||
}
|
||||
{% endif %}
|
||||
# Private TLS ACME with DNS-01-challenge
|
||||
(private_tls) {
|
||||
tls {
|
||||
issuer acme {
|
||||
dir https://{{ services['ca']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['ca']['ports']['https'] }}/acme/acme@{{ domain['internal'] }}/directory
|
||||
dns rfc2136 {
|
||||
server {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['bind']['ports']['dns'] }}
|
||||
key_name acme-key
|
||||
key_alg hmac-sha256
|
||||
key "{file./run/secrets/CADDY_ACME_KEY}"
|
||||
}
|
||||
resolvers {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}
|
||||
}
|
||||
}
|
||||
}
|
||||
# Node domain
|
||||
{{ node['name'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
metrics
|
||||
}
|
||||
# Applications
|
||||
{% for item in caddy_services %}
|
||||
{% set service = services[item] %}
|
||||
{% set web_type = service['dependency']['web'] %}
|
||||
{% if node['name'] == 'auth' %}
|
||||
{% if service['domain']['public'] == '@' %}
|
||||
{{ domain['public'] }} {
|
||||
{% else %}
|
||||
{{ service['domain']['public'] }}.{{ domain['public'] }} {
|
||||
{% endif %}
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
{% if web_type == 'auth-public' %}
|
||||
reverse_proxy host.containers.internal:{{ service['ports']['http'] }}
|
||||
{% else %}
|
||||
reverse_proxy https://{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
{% endif %}
|
||||
}
|
||||
}
|
||||
{% elif node['name'] == 'infra' %}
|
||||
{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
route {
|
||||
{% if service['ports']['https'] is defined %}
|
||||
reverse_proxy https://{{ service['domain']['internal'] }}.{{ domain['internal'] }}:{{ service['ports']['https'] }}
|
||||
{% else %}
|
||||
reverse_proxy host.containers.internal:{{ service['ports']['http'] }}
|
||||
{% endif %}
|
||||
}
|
||||
}
|
||||
{% elif node['name'] == 'app' %}
|
||||
{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ service['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{% endif %}
|
||||
{% endfor %}{{ '' }}
|
||||
@@ -1,91 +0,0 @@
|
||||
{
|
||||
servers {
|
||||
# Only accept packets from auth main caddy
|
||||
trusted_proxies static {{ hostvars['fw']['network4']['auth']['server'] }} {{ hostvars['fw']['network6']['auth']['server'] }}
|
||||
}
|
||||
}
|
||||
# Private TLS ACME with DNS-01-challenge
|
||||
(private_tls) {
|
||||
tls {
|
||||
issuer acme {
|
||||
dir https://{{ services['ca']['domain'] }}.{{ domain['internal'] }}:{{ services['ca']['ports']['https'] }}/acme/acme@{{ domain['internal'] }}/directory
|
||||
dns rfc2136 {
|
||||
server {{ services['bind']['domain'] }}.{{ domain['internal'] }}:{{ services['bind']['ports']['dns'] }}
|
||||
key_name acme-key
|
||||
key_alg hmac-sha256
|
||||
key "{file./run/secrets/CADDY_ACME_KEY}"
|
||||
}
|
||||
resolvers {{ services['bind']['domain'] }}.{{ domain['internal'] }}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
{{ node['name'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
metrics
|
||||
}
|
||||
# test.app.ilnmors.internal {
|
||||
# import private_tls
|
||||
# root * /usr/share/caddy
|
||||
# file_server
|
||||
# }
|
||||
{{ services['vaultwarden']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['vaultwarden']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['gitea']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['gitea']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['immich']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['immich']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['paperless']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['paperless']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['nextcloud']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['nextcloud']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['collabora']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['collabora']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['sure']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['sure']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['outline']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['outline']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['memos']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['memos']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
{{ services['mealie']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
reverse_proxy host.containers.internal:{{ services['mealie']['ports']['http'] }} {
|
||||
header_up Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
@@ -1,162 +0,0 @@
|
||||
{
|
||||
# CrowdSec LAPI connection
|
||||
crowdsec {
|
||||
api_url https://{{ services['crowdsec']['domain'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}
|
||||
api_key "{file./run/secrets/CADDY_CROWDSEC_KEY}"
|
||||
}
|
||||
}
|
||||
|
||||
# Snippets
|
||||
# CrowdSec log for parser
|
||||
(crowdsec_log) {
|
||||
log {
|
||||
output file /log/access.log {
|
||||
mode 0644
|
||||
roll_size 100MiB
|
||||
roll_keep 1
|
||||
}
|
||||
format json
|
||||
}
|
||||
}
|
||||
# Private TLS ACME with DNS-01-challenge
|
||||
(private_tls) {
|
||||
tls {
|
||||
issuer acme {
|
||||
dir https://{{ services['ca']['domain'] }}.{{ domain['internal'] }}:{{ services['ca']['ports']['https'] }}/acme/acme@{{ domain['internal'] }}/directory
|
||||
dns rfc2136 {
|
||||
server {{ services['bind']['domain'] }}.{{ domain['internal'] }}:{{ services['bind']['ports']['dns'] }}
|
||||
key_name acme-key
|
||||
key_alg hmac-sha256
|
||||
key "{file./run/secrets/CADDY_ACME_KEY}"
|
||||
}
|
||||
resolvers {{ services['bind']['domain'] }}.{{ domain['internal'] }}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Public domain
|
||||
{{ services['authelia']['domain'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy host.containers.internal:{{ services['authelia']['ports']['http'] }}
|
||||
}
|
||||
}
|
||||
# test.ilnmors.com {
|
||||
# import crowdsec_log
|
||||
# route {
|
||||
# crowdsec
|
||||
# forward_auth host.containers.internal:9091 {
|
||||
# # Authelia Forward Auth endpoint URI
|
||||
# uri /api/authz/forward-auth
|
||||
# copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
||||
# }
|
||||
# root * /usr/share/caddy
|
||||
# file_server
|
||||
# }
|
||||
# }
|
||||
# test.app.ilnmors.com {
|
||||
# import crowdsec_log
|
||||
# route {
|
||||
# crowdsec
|
||||
# reverse_proxy https://test.app.ilnmors.internal {
|
||||
# header_up Host {http.reverse_proxy.upstream.host}
|
||||
# }
|
||||
# }
|
||||
# }
|
||||
{{ services['vaultwarden']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{ services['vaultwarden']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['gitea']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{ services['gitea']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['immich']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{ services['immich']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['paperless']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{ services['paperless']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{services['nextcloud']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['collabora']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{services['collabora']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['sure']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{services['sure']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['outline']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{services['outline']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['memos']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{services['memos']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }} {
|
||||
import crowdsec_log
|
||||
route {
|
||||
crowdsec
|
||||
reverse_proxy https://{{services['mealie']['domain']['internal'] }}.{{ domain['internal'] }} {
|
||||
header_up Host {http.reverse_proxy.upstream.host}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Internal domain
|
||||
{{ node['name'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
metrics
|
||||
}
|
||||
@@ -1,41 +0,0 @@
|
||||
# Private TLS ACME with DNS-01-challenge
|
||||
(private_tls) {
|
||||
tls {
|
||||
issuer acme {
|
||||
dir https://{{ services['ca']['domain'] }}.{{ domain['internal'] }}:{{ services['ca']['ports']['https'] }}/acme/acme@{{ domain['internal'] }}/directory
|
||||
dns rfc2136 {
|
||||
server {{ services['bind']['domain'] }}.{{ domain['internal'] }}:{{ services['bind']['ports']['dns'] }}
|
||||
key_name acme-key
|
||||
key_alg hmac-sha256
|
||||
key "{file./run/secrets/CADDY_ACME_KEY}"
|
||||
}
|
||||
resolvers {{ services['bind']['domain'] }}.{{ domain['internal'] }}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
{{ node['name'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
metrics
|
||||
}
|
||||
|
||||
{{ services['ldap']['domain'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
route {
|
||||
reverse_proxy host.containers.internal:{{ services['ldap']['ports']['http'] }}
|
||||
}
|
||||
}
|
||||
|
||||
{{ services['prometheus']['domain'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
route {
|
||||
reverse_proxy https://{{ services['prometheus']['domain'] }}.{{ domain['internal'] }}:{{ services['prometheus']['ports']['https'] }}
|
||||
}
|
||||
}
|
||||
|
||||
{{ services['grafana']['domain'] }}.{{ domain['internal'] }} {
|
||||
import private_tls
|
||||
route {
|
||||
reverse_proxy host.containers.internal:{{ services['grafana']['ports']['http'] }}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user