feat: add management stack (portainer, uptime-kuma, homarr)

Add portainer, uptime-kuma, and homarr on a new 'management' network, with caddy joined to it and internal-only Caddy routes for portainer/uptime/homarr/router. Widen the internal_only allowlist to also accept 172.16.0.0/12 (Docker networks) and 127.0.0.1 so container-originated and local checks pass the LAN gate.
2026-06-03 04:06:55 -05:00
parent 24e0f870dd
commit 16b08bad8a
2 changed files with 63 additions and 1 deletions
@@ -11,7 +11,7 @@
 # Reusable matcher — blocks anything not on the LAN.
 # Usage: import internal_only inside any site block.
 (internal_only) {
-	@blocked not remote_ip 192.168.1.0/24
+	@blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 127.0.0.1
 	respond @blocked "Access denied" 403
 }

@@ -208,3 +208,26 @@ auth.ginnoir.com {
 dev.ginnoir.com {
       reverse_proxy 192.168.1.74:3000
 }
+
+# =============================================================
+# MANAGEMENT — internal only
+# =============================================================
+portainer.ginnoir.com {
+	import internal_only
+	reverse_proxy portainer:9000
+}
+
+uptime.ginnoir.com {
+	import internal_only
+	reverse_proxy uptime-kuma:3001
+}
+
+homarr.ginnoir.com {
+	import internal_only
+	reverse_proxy homarr:7575
+}
+
+router.ginnoir.com {
+	import internal_only
+	reverse_proxy 192.168.1.1
+}