{% if node['name'] == 'auth' %}
{
        # CrowdSec LAPI connection
        crowdsec {
                api_url https://{{ services['crowdsec']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}
                api_key "{file./run/secrets/CADDY_CROWDSEC_KEY}"
        }
}

# Snippets
# CrowdSec log for parser
(crowdsec_log) {
        log {
                output file /log/access.log {
                        mode 0644
                        roll_size 100MiB
                        roll_keep 1
                }
                format json
        }
}
{% endif %}
{% if node['name'] == 'app' %}
{
        servers {
                trusted_proxies static {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
        }
}
{% endif %}
# Private TLS ACME with DNS-01-challenge
(private_tls) {
        tls {
                issuer acme {
                        dir https://{{ services['ca']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['ca']['ports']['https'] }}/acme/acme@{{ domain['internal'] }}/directory
                        dns rfc2136 {
                                server {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['bind']['ports']['dns'] }}
                                key_name acme-key
                                key_alg hmac-sha256
                                key "{file./run/secrets/CADDY_ACME_KEY}"
                        }
                        resolvers {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}
                }
        }
}
# Node domain
{{ node['name'] }}.{{ domain['internal'] }} {
        import private_tls
        metrics
}
# Applications
{% for item in caddy_services %}
{% set service = services[item] %}
{% set web_type = service['dependency']['web'] %}
{% if node['name'] == 'auth' %}
{% if service['domain']['public'] == '@' %}
{{ domain['public'] }}, www.{{ domain['public'] }} {
{% else %}
{{ service['domain']['public'] }}.{{ domain['public'] }} {
{% endif %}
        import crowdsec_log
        route {
                crowdsec
{% if service['route'] is defined and service['route']['dav'] is defined and service['route']['dav'] %}
                redir /.well-known/caldav /dav 301
                redir /.well-known/carddav /dav 301
{% endif %}
{% if web_type == 'auth-public' %}
                reverse_proxy host.containers.internal:{{ service['ports']['http'] }}
{% else %}
                reverse_proxy https://{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
                        header_up Host {http.reverse_proxy.upstream.host}
                }
{% endif %}
        }
}
{% elif node['name'] == 'infra' %}
{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
        import private_tls
        route {
        {% if service['ports']['https'] is defined %}
                reverse_proxy https://{{ service['domain']['internal'] }}.{{ domain['internal'] }}:{{ service['ports']['https'] }}
        {% else %}
                reverse_proxy host.containers.internal:{{ service['ports']['http'] }}
        {% endif %}
        }
}
{% elif node['name'] == 'app' %}
{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
        import private_tls
{% if service['route'] is defined and service['route']['deny'] is defined %}
        @deny path {{ service['route']['deny'] }}
        respond @deny 404
{% endif %}
{% if service['route'] is defined and service['route']['api'] is defined %}
        @api path {{ service['route']['api'] }}
        reverse_proxy @api host.containers.internal:{{ service['ports']['api'] }} {
                header_up Host {http.request.header.X-Forwarded-Host}
        }
{% endif %}
        reverse_proxy host.containers.internal:{{ service['ports']['http'] }} {
               header_up Host {http.request.header.X-Forwarded-Host}
        }
}
{% endif %}
{% endfor %}{{ '' }}