homelabstack/Caddyfile

# =============================================================
# GLOBAL OPTIONS
# =============================================================
{
	acme_dns cloudflare {env.CF_API_TOKEN}
}

# =============================================================
# SNIPPETS
# =============================================================
# Reusable matcher — blocks anything not on the LAN or tailnet.
# Usage: import internal_only inside any site block.
# 100.64.0.0/10 is the Tailscale CGNAT range — allows tailnet clients that
# reach Caddy without subnet-route SNAT (i.e. --snat-subnet-routes=false).
(internal_only) {
	@blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 100.64.0.0/10 127.0.0.1
	respond @blocked "Access denied" 403
}

# =============================================================
# FOUNDRY VTT — public
# =============================================================
foundry.ginnoir.com {
	reverse_proxy foundry:30000
}

foundry2.ginnoir.com {
	reverse_proxy foundry2:30000
}

# =============================================================
# TABLETOP TOOLS — public
# =============================================================
5etools.ginnoir.com {
	reverse_proxy 5etools:80
}

pf2e.ginnoir.com {
	root * /srv/aon
	file_server
}

# =============================================================
# FILE STORAGE — public
# =============================================================
files.ginnoir.com {
	reverse_proxy owncloud:8080
}

# =============================================================
# STATIC SITES — public
# =============================================================
ffttsystems.ginnoir.com {
	root * /srv/ffttsystems
	file_server
}

# =============================================================
# MEDIA REQUESTS — public
# =============================================================
requests.ginnoir.com {
	reverse_proxy overseerr:5055
}

# =============================================================
# MEDIA MANAGEMENT — internal only
# =============================================================
sonarr.ginnoir.com {
	import internal_only
	reverse_proxy sonarr:8989
}

radarr.ginnoir.com {
	import internal_only
	reverse_proxy radarr:7878
}

bazarr.ginnoir.com {
	import internal_only
	reverse_proxy bazarr:6767
}

prowlarr.ginnoir.com {
	import internal_only
	reverse_proxy prowlarr:9696
}

tautulli.ginnoir.com {
	import internal_only
	reverse_proxy tautulli:8181
}

# =============================================================
# DOWNLOAD CLIENTS — internal only
# =============================================================
qbittorrent.ginnoir.com {
	import internal_only
	reverse_proxy qbittorrent:3232
}

deluge.ginnoir.com {
	import internal_only
	reverse_proxy deluge:8112
}

nzbget.ginnoir.com {
	import internal_only
	reverse_proxy nzbget:6789
}

whisparr.ginnoir.com {
	import internal_only
	reverse_proxy whisparr:6969
}

stash.ginnoir.com {
	import internal_only
	reverse_proxy stash:6970
}

# =============================================================
# GAMES / ROMS — public (temporarily; RomM has its own auth)
# =============================================================
roms.ginnoir.com {
	# WORKAROUND (2026-06-06): RomM 4.8.x 500s on a malformed Authorization
	# header — hybrid_auth.py does `scheme, token = header.split()` with no
	# guard, so a value with !=2 space-separated parts raises ValueError.
	# decky-romm-sync >=0.20.0 sends `Authorization: Bearer ` (empty token) on
	# its first-run probes, before it has minted a Client API Token, which trips
	# that crash and deadlocks setup (heartbeat/platforms/devices all 500).
	# Strip the empty-token header so the heartbeat probe returns 200 and the
	# Basic-auth token mint (POST /api/client-tokens) can run. Real `Bearer
	# rmm_…` tokens and browser session-cookie auth are unaffected. Remove once
	# the plugin omits the empty header (or RomM guards the split).
	@romm_empty_bearer header_regexp Authorization "^Bearer\s*$"
	handle @romm_empty_bearer {
		reverse_proxy romm:8080 {
			header_up -Authorization
		}
	}
	handle {
		reverse_proxy romm:8080
	}
}

# =============================================================
# NOTIFICATIONS & RSS — public
# =============================================================
ntfy.ginnoir.com, http://ntfy.ginnoir.com {
	reverse_proxy ntfy:80
	@httpget {
		protocol http
		method GET
		path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
	}
	redir @httpget https://{host}{uri}
}

freshrss.ginnoir.com {
	reverse_proxy freshrss:80
}

# =============================================================
# RESUME / PORTFOLIO — public
# =============================================================
resume.ginnoir.com {
	reverse_proxy app:3000
}

j-costa.com, https://j-costa.com {
	tls {
		issuer acme {
			disable_tlsalpn_challenge
		}
	}
	redir * https://resume.ginnoir.com/ginnoir/resume permanent
}

storage.j-costa.com, https://storage.j-costa.com {
	tls {
		issuer acme {
			disable_tlsalpn_challenge
		}
	}
	reverse_proxy resume-minio:9000
}

# =============================================================
# MINIO CONSOLE — internal only
# =============================================================
minio.ginnoir.com {
	import internal_only
	reverse_proxy resume-minio:9001
}

# =============================================================
# FAMAPP & AUTH — public
# =============================================================
fam.ginnoir.com {
	reverse_proxy famapp:3000
}

auth.ginnoir.com {
	reverse_proxy authentik-server:9000
}

dev.ginnoir.com {
	reverse_proxy 192.168.1.74:3000
}

# =============================================================
# MANAGEMENT — internal only
# =============================================================
portainer.ginnoir.com {
	@webhook {
		method POST
		path /api/stacks/webhooks/*
	}

	handle @webhook {
		reverse_proxy portainer:9000
	}

	handle {
		import internal_only
		reverse_proxy portainer:9000
	}
}

uptime.ginnoir.com {
	import internal_only
	reverse_proxy uptime-kuma:3001
}

homarr.ginnoir.com {
	import internal_only
	reverse_proxy homarr:7575
}

router.ginnoir.com {
	import internal_only
	reverse_proxy 192.168.1.1
}

# =============================================================
# DEV STACK — internal only
# =============================================================
gitea.ginnoir.com {
	import internal_only
	reverse_proxy gitea:3000
}

code.ginnoir.com {
	import internal_only
	reverse_proxy code_server:8443
}

registry.ginnoir.com {
	import internal_only
	reverse_proxy registry:5000
}

registry-ui.ginnoir.com {
	import internal_only
	reverse_proxy registry_ui:80
}

dbx.ginnoir.com {
	import internal_only
	reverse_proxy dbx:4224
}

vault.ginnoir.com {
	import internal_only
	reverse_proxy vault:8200
}

docs.ginnoir.com {
	import internal_only
	reverse_proxy bookstack:80
}

plane.ginnoir.com {
	import internal_only
	handle /api/* {
		reverse_proxy plane_api:8000
	}
	handle /auth/* {
		reverse_proxy plane_api:8000
	}
	handle {
		reverse_proxy plane_web:3000
	}
}

# =============================================================
# NOTES / PKM — public (obsidian-livesync syncs from any device)
# =============================================================
obsidian.ginnoir.com {
	reverse_proxy couchdb:5984
}