94 lines
2.4 KiB
Caddyfile
94 lines
2.4 KiB
Caddyfile
{
|
|
email {$ACME_EMAIL:[email protected]}
|
|
|
|
servers {
|
|
# cloudflared and Docker's gateways sit on private ranges. Take the real
|
|
# client IP from their headers instead of reporting their own address;
|
|
# upstreams receive it in X-Forwarded-For.
|
|
trusted_proxies static private_ranges
|
|
client_ip_headers Cf-Connecting-Ip X-Forwarded-For
|
|
}
|
|
}
|
|
|
|
# Reusable TLS block using Cloudflare DNS-01 ACME challenge (Let's Encrypt / ZeroSSL)
|
|
(cloudflare_tls) {
|
|
tls {
|
|
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
|
|
}
|
|
}
|
|
|
|
# Synotrip (PHP 8.3 / MariaDB / Redis)
|
|
synotrip.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy host.docker.internal:3200
|
|
}
|
|
|
|
npm.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy host.docker.internal:4873
|
|
}
|
|
|
|
# Blog (PHP 8.3 / MariaDB)
|
|
blog.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy host.docker.internal:3201
|
|
}
|
|
|
|
|
|
# Gitea on Z2Pro
|
|
gitea.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy 192.168.50.228:8081
|
|
}
|
|
|
|
*.ddev.kucial.com {
|
|
tls {
|
|
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
|
|
}
|
|
|
|
@api host gig-api.ddev.kucial.com
|
|
handle @api {
|
|
reverse_proxy https://192.168.50.160:443 {
|
|
header_up Host gig-platform.ddev.site
|
|
transport http {
|
|
tls_server_name gig-platform.ddev.site
|
|
# The public device-facing certificate is still fully trusted.
|
|
# This applies only to the fixed, private Caddy-to-DDEV hop.
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
@socket host gig-socket.ddev.kucial.com
|
|
handle @socket {
|
|
reverse_proxy http://192.168.50.160:6001 {
|
|
header_up Host gig-platform.ddev.site
|
|
}
|
|
}
|
|
|
|
@voice host gig-voice.ddev.kucial.com
|
|
handle @voice {
|
|
reverse_proxy http://192.168.50.160:7880 {
|
|
header_up Host gig-platform.ddev.site
|
|
}
|
|
}
|
|
|
|
@static host gig-static.ddev.kucial.com
|
|
handle @static {
|
|
reverse_proxy https://192.168.50.160:443 {
|
|
header_up Host gig-platform.ddev.site
|
|
transport http {
|
|
tls_server_name gig-platform.ddev.site
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
respond 404
|
|
}
|
|
|
|
# Per-project sites, one file each (sites/*.caddy). Project instances are
|
|
# reached over the shared `edge` Docker network by container alias rather than
|
|
# host ports — see sites/gig-platform.caddy.
|
|
import sites/*.caddy
|