106 lines
3.9 KiB
Caddyfile
106 lines
3.9 KiB
Caddyfile
{% if node['name'] == 'auth' %}
|
|
{
|
|
# CrowdSec LAPI connection
|
|
crowdsec {
|
|
api_url https://{{ services['crowdsec']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}
|
|
api_key "{file./run/secrets/CADDY_CROWDSEC_KEY}"
|
|
}
|
|
}
|
|
|
|
# Snippets
|
|
# CrowdSec log for parser
|
|
(crowdsec_log) {
|
|
log {
|
|
output file /log/access.log {
|
|
mode 0644
|
|
roll_size 100MiB
|
|
roll_keep 1
|
|
}
|
|
format json
|
|
}
|
|
}
|
|
{% endif %}
|
|
{% if node['name'] == 'app' %}
|
|
{
|
|
servers {
|
|
trusted_proxies static {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}
|
|
}
|
|
}
|
|
{% endif %}
|
|
# Private TLS ACME with DNS-01-challenge
|
|
(private_tls) {
|
|
tls {
|
|
issuer acme {
|
|
dir https://{{ services['ca']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['ca']['ports']['https'] }}/acme/acme@{{ domain['internal'] }}/directory
|
|
dns rfc2136 {
|
|
server {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['bind']['ports']['dns'] }}
|
|
key_name acme-key
|
|
key_alg hmac-sha256
|
|
key "{file./run/secrets/CADDY_ACME_KEY}"
|
|
}
|
|
resolvers {{ services['bind']['domain']['internal'] }}.{{ domain['internal'] }}
|
|
}
|
|
}
|
|
}
|
|
# Node domain
|
|
{{ node['name'] }}.{{ domain['internal'] }} {
|
|
import private_tls
|
|
metrics
|
|
}
|
|
# Applications
|
|
{% for item in caddy_services %}
|
|
{% set service = services[item] %}
|
|
{% set web_type = service['dependency']['web'] %}
|
|
{% if node['name'] == 'auth' %}
|
|
{% if service['domain']['public'] == '@' %}
|
|
{{ domain['public'] }}, www.{{ domain['public'] }} {
|
|
{% else %}
|
|
{{ service['domain']['public'] }}.{{ domain['public'] }} {
|
|
{% endif %}
|
|
import crowdsec_log
|
|
route {
|
|
crowdsec
|
|
{% if service['route'] is defined and service['route']['dav'] is defined and service['route']['dav'] %}
|
|
redir /.well-known/caldav /dav 301
|
|
redir /.well-known/carddav /dav 301
|
|
{% endif %}
|
|
{% if web_type == 'auth-public' %}
|
|
reverse_proxy host.containers.internal:{{ service['ports']['http'] }}
|
|
{% else %}
|
|
reverse_proxy https://{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
|
|
header_up Host {http.reverse_proxy.upstream.host}
|
|
}
|
|
{% endif %}
|
|
}
|
|
}
|
|
{% elif node['name'] == 'infra' %}
|
|
{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
|
|
import private_tls
|
|
route {
|
|
{% if service['ports']['https'] is defined %}
|
|
reverse_proxy https://{{ service['domain']['internal'] }}.{{ domain['internal'] }}:{{ service['ports']['https'] }}
|
|
{% else %}
|
|
reverse_proxy host.containers.internal:{{ service['ports']['http'] }}
|
|
{% endif %}
|
|
}
|
|
}
|
|
{% elif node['name'] == 'app' %}
|
|
{{ service['domain']['internal'] }}.{{ domain['internal'] }} {
|
|
import private_tls
|
|
{% if service['route'] is defined and service['route']['deny'] is defined %}
|
|
@deny path {{ service['route']['deny'] }}
|
|
respond @deny 404
|
|
{% endif %}
|
|
{% if service['route'] is defined and service['route']['api'] is defined %}
|
|
@api path {{ service['route']['api'] }}
|
|
reverse_proxy @api host.containers.internal:{{ service['ports']['api'] }} {
|
|
header_up Host {http.request.header.X-Forwarded-Host}
|
|
}
|
|
{% endif %}
|
|
reverse_proxy host.containers.internal:{{ service['ports']['http'] }} {
|
|
header_up Host {http.request.header.X-Forwarded-Host}
|
|
}
|
|
}
|
|
{% endif %}
|
|
{% endfor %}{{ '' }}
|