ginnoir
1028bc3a74
Deploy Caddyfile to valhalla / deploy (push) Successful in 1m28s
The mirror is static files; keeping it in a container burned root disk. Caddy file_server bind-mounts /storage1/labdata/5etools like the other static sites.
67 lines
2.7 KiB
YAML
67 lines
2.7 KiB
YAML
# proxy stack — Caddy reverse proxy / TLS terminator.
|
|
#
|
|
# Caddy is the single ingress for the whole estate. It joins only the shared
|
|
# `edge` network (owned by the management plane); every service it proxies also
|
|
# joins `edge`, so `reverse_proxy <service>:<port>` resolves by container name.
|
|
# This replaces Caddy's old membership in 11 separate per-stack networks.
|
|
#
|
|
# The Caddyfile itself is unchanged — upstreams are service names that resolve
|
|
# over edge. It is bind-mounted from /config/caddy/Caddyfile and hot-reloaded
|
|
# by the Gitea Actions runner on push (.gitea/workflows/deploy-caddy.yml).
|
|
#
|
|
# serfriz/caddy-cloudflare-ddns bundles caddy-dns/cloudflare (DNS-01 ACME),
|
|
# caddy-cloudflare-ip (real client IPs behind CF), caddy-dynamicdns.
|
|
|
|
services:
|
|
caddy:
|
|
container_name: caddy
|
|
image: serfriz/caddy-cloudflare-ddns:2.11.3
|
|
restart: unless-stopped
|
|
labels:
|
|
- "com.centurylabs.watchtower.enable=false"
|
|
# Public resolvers for ACME DNS-01 zone detection.
|
|
#
|
|
# The LAN resolver (OPNsense Unbound, 192.168.1.1) is authoritative for
|
|
# ginnoir.com via the split-horizon override, but its local-zone only holds
|
|
# A records — so `SOA ginnoir.com` returns NODATA. certmagic's zone lookup
|
|
# walks up the label chain looking for an SOA, finds none at ginnoir.com,
|
|
# climbs to `com.`, and asks Cloudflare for a `com` zone. Result:
|
|
# "adding temporary record for zone \"com.\": expected 1 zone, got 0"
|
|
# and every DNS-01 renewal fails until certs expire.
|
|
#
|
|
# Docker's embedded DNS (127.0.0.11) still resolves container names and the
|
|
# gitea.ginnoir.com alias below; only external lookups go to Cloudflare.
|
|
dns:
|
|
- 1.1.1.1
|
|
- 1.0.0.1
|
|
networks:
|
|
edge:
|
|
aliases:
|
|
- gitea.ginnoir.com
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
env_file:
|
|
- stack.env
|
|
volumes:
|
|
- /config/caddy/Caddyfile:/etc/caddy/Caddyfile
|
|
- /config/caddy/site:/srv
|
|
- /config/caddy/data:/data
|
|
- /config/caddy/config:/config
|
|
- /storage1/Books:/srv/Books
|
|
# Pokémon ROM-hack library (box art + guides + spreadsheets), served
|
|
# read-only and LAN-only by the romhacks-files.ginnoir.com site so the
|
|
# Obsidian catalog notes can embed art and link guides.
|
|
- /storage1/labdata/romhacks/library:/srv/romhacks:ro
|
|
# ROM files are exposed only through romhacks-files.ginnoir.com/_roms/*
|
|
# and that site imports internal_only in the Caddyfile.
|
|
- /storage1/Emulation/roms:/srv/roms:ro
|
|
# 5etools mirror — static files on ZFS. Serving via Caddy file_server
|
|
# instead of ghcr.io/5etools-mirror-3/5etools-src (~14G image on root).
|
|
- /storage1/labdata/5etools:/srv/5etools:ro
|
|
|
|
networks:
|
|
edge:
|
|
name: edge
|
|
external: true
|