dockerserver-scott/reverseproxy2/caddy/Caddyfile

# --------------------------------------------------
# global options
# --------------------------------------------------
{
	acme_ca https://acme-staging-v02.api.letsencrypt.org/directory

	admin :2019

	servers {
		trusted_proxies static private_ranges
	}

}

# --------------------------------------------------
# cloudflare tls snippet for sites
# --------------------------------------------------

(cloudflare) {
	tls {
		dns cloudflare BI5kO2I9fHAqso_OClKxbUM6xTCodH2OfQ60yNp3
		resolvers 1.1.1.1 1.0.0.1
	}
}

# --------------------------------------------------
# auth snippet for authelia
# --------------------------------------------------

(auth) {
	forward_auth localhost:9091 {
		uri /api/authz/forward-auth
		copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
	}
}

# --------------------------------------------------
# wettsten.com root domain
# --------------------------------------------------

wettsten.com {
	import cloudflare
	@akanealwcom host wettsten.com
	handle @akanealwcom {
		import auth
		reverse_proxy 192.168.1.4:3005
	}
}

# --------------------------------------------------
# authelia subdomain
# --------------------------------------------------

auth.wettsten.com {
	import cloudflare
	reverse_proxy localhost:9091
}

# --------------------------------------------------
# *.wettsten.com subdomains
# --------------------------------------------------

*.wettsten.com {
	# --------------------------------------------------
	# internal only subdomains
	#
	#
	#        @ host .wettsten.com
	#        handle @ {
	#                        handle @internal {
	#                                reverse_proxy 192.168.1.
	#                }
	#                respond "ip range not allowed"
	#        }
	#
	#
	#       @ host .wettsten.com
	#       handle @ {
	#                       handle @internal {
	#                               reverse_proxy https://192.168.1. {
	#                                        transport http {
	#                                                tls_insecure_skip_verify
	#                                        }
	#                               }
	#               }
	#               respond "ip range not allowed"
	#       }
	#
	#
	# --------------------------------------------------
	@internal client_ip 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 127.0.0.1/8
	@external not client_ip 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 127.0.0.1/8
	import cloudflare

	@checkmk host checkmk.wettsten.com
	handle @checkmk {
		handle @internal {
			reverse_proxy 192.168.1.4:8888
		}
		respond "ip range not allowed"
	}

	@linkwarden host linkwarden.wettsten.com
	handle @linkwarden {
		handle @internal {
			reverse_proxy 192.168.1.4:3232
		}
		respond "ip range not allowed"
	}

	@adguard1 host adguardserver1.wettsten.com
	handle @adguard1 {
		handle @internal {
			reverse_proxy 192.168.1.2:80
		}
		respond "ip range not allowed"
	}

	@adguard2 host adguardserver2.wettsten.com
	handle @adguard2 {
		handle @internal {
			reverse_proxy 192.168.1.3:80
		}
		respond "ip range not allowed"
	}

	@bale host bale.wettsten.com
	handle @bale {
		handle @internal {
			reverse_proxy 192.168.1.51:8080
		}
		respond "ip range not allowed"
	}

	@cronicle host cronicle.wettsten.com
	handle @cronicle {
		handle @internal {
			reverse_proxy 192.168.1.30:3012
		}
		respond "ip range not allowed"
	}

	@devdockge host dev-dockge.wettsten.com
	handle @devdockge {
		handle @internal {
			reverse_proxy 192.168.1.35:5001
		}
		respond "ip range not allowed"
	}

	@devdozzle host dev-dozzle.wettsten.com
	handle @devdozzle {
		handle @internal {
			reverse_proxy 192.168.1.35:8080
		}
		respond "ip range not allowed"
	}

	@dockerdockge host dockerserver-dockge.wettsten.com
	handle @dockerdockge {
		handle @internal {
			reverse_proxy 192.168.1.30:5001
		}
		respond "ip range not allowed"
	}

	@dockerdozzle host dockerserver-dozzle.wettsten.com
	handle @dockerdozzle {
		handle @internal {
			reverse_proxy 192.168.1.30:8080
		}
		respond "ip range not allowed"
	}

	@dockertestdockge host dockerservertest-dockge.wettsten.com
	handle @dockertestdockge {
		handle @internal {
			reverse_proxy 192.168.1.33:5001
		}
		respond "ip range not allowed"
	}

	@dockertestdozzle host dockerservertest-dozzle.wettsten.com
	handle @dockertestdozzle {
		handle @internal {
			reverse_proxy 192.168.1.33:8080
		}
		respond "ip range not allowed"
	}

	@proxyserverdockge host proxyserver-dockge.wettsten.com
	handle @proxyserverdockge {
		handle @internal {
			reverse_proxy 192.168.1.4:5001
		}
		respond "ip range not allowed"
	}

	@proxyserverdozzle host proxyserver-dozzle.wettsten.com
	handle @proxyserverdozzle {
		handle @internal {
			reverse_proxy 192.168.1.4:8080
		}
		respond "ip range not allowed"
	}

	@files host files.wettsten.com
	handle @files {
		handle @internal {
			redir / /files{uri}
			reverse_proxy 192.168.1.50:80
		}
		respond "ip range not allowed"
	}

	@icons host icons.wettsten.com
	handle @icons {
		handle @internal {
			rewrite * /files/icons{uri}
			reverse_proxy 192.168.1.50:80
		}
		respond "ip range not allowed"
	}

	@gluetun host gluetun.wettsten.com
	handle @gluetun {
		handle @internal {
			reverse_proxy 192.168.1.30:8777
		}
		respond "ip range not allowed"
	}

	@peanut host peanut.wettsten.com
	handle @peanut {
		handle @internal {
			reverse_proxy 192.168.1.30:8980
		}
		respond "ip range not allowed"
	}

	@photoprism host photoprism.wettsten.com
	handle @photoprism {
		handle @internal {
			reverse_proxy 192.168.1.30:2342
		}
		respond "ip range not allowed"
	}

	@photoprismdadandmom host photos.wettsten.com
	handle @photoprismdadandmom {
		handle @internal {
			reverse_proxy 192.168.1.25:2342
		}
		respond "ip range not allowed"
	}

	@proxmox1 host proxmox1.wettsten.com
	handle @proxmox1 {
		handle @internal {
			reverse_proxy https://192.168.1.51:8006 {
				transport http {
					tls_insecure_skip_verify
				}
			}
		}
		respond "ip range not allowed"
	}

	@proxmox2 host proxmox2.wettsten.com
	handle @proxmox2 {
		handle @internal {
			reverse_proxy https://192.168.1.52:8006 {
				transport http {
					tls_insecure_skip_verify
				}
			}
		}
		respond "ip range not allowed"
	}

	@proxmoxbackup host proxmoxbackup.wettsten.com
	handle @proxmoxbackup {
		handle @internal {
			reverse_proxy https://192.168.1.51:8007 {
				transport http {
					tls_insecure_skip_verify
				}
			}
		}
		respond "ip range not allowed"
	}

	@router host router.wettsten.com
	handle @router {
		handle @internal {
			reverse_proxy https://192.168.1.1:443 {
				transport http {
					tls_insecure_skip_verify
				}
			}
		}
		respond "ip range not allowed"
	}

	@rssbridge host rss-bridge.wettsten.com
	handle @rssbridge {
		handle @internal {
			reverse_proxy 192.168.1.30:3006
		}
		respond "ip range not allowed"
	}

	@invidious host invidious.wettsten.com
	handle @invidious {
		handle @internal {
			reverse_proxy 192.168.1.30:3000
		}
		respond "ip range not allowed"
	}

	@scripts host scripts.wettsten.com
	handle @scripts {
		handle @internal {
			redir / /scripts{uri}
			reverse_proxy 192.168.1.50:80
		}
		respond "ip range not allowed"
	}

	@speedtest host speedtest.wettsten.com
	handle @speedtest {
		handle @internal {
			reverse_proxy 192.168.1.30:8765
		}
		respond "ip range not allowed"
	}

	@dockersyncthing host dockerserver-syncthing.wettsten.com
	handle @dockersyncthing {
		handle @internal {
			reverse_proxy https://192.168.1.30:8384 {
				transport http {
					tls_insecure_skip_verify
				}
			}
		}
		respond "ip range not allowed"
	}

	@gamingpcsyncthing host gamingpc-syncthing.wettsten.com
	handle @gamingpcsyncthing {
		handle @internal {
			reverse_proxy https://192.168.1.11:8384 {
				transport http {
					tls_insecure_skip_verify
				}
			}
		}
		respond "ip range not allowed"
	}

	@laptoppcsyncthing host laptoppc-syncthing.wettsten.com
	handle @laptoppcsyncthing {
		handle @internal {
			reverse_proxy https://192.168.1.12:8384 {
				transport http {
					tls_insecure_skip_verify
				}
			}
		}
		respond "ip range not allowed"
	}

	@webmin host webmin.wettsten.com
	handle @webmin {
		handle @internal {
			reverse_proxy https://192.168.1.51:10000 {
				transport http {
					tls_insecure_skip_verify
				}
			}
		}
		respond "ip range not allowed"
	}

	@wireguardui host wireguardui.wettsten.com
	handle @wireguardui {
		handle @internal {
			reverse_proxy 192.168.1.4:5000
		}
		respond "ip range not allowed"
	}

	@zabbix host zabbix.wettsten.com
	handle @zabbix {
		handle @internal {
			reverse_proxy 192.168.1.44:8080
		}
		respond "ip range not allowed"
	}

	@piholewg host pihole-wg.wettsten.com
	handle @piholewg {
		handle @internal {
			redir / /admin{uri}
			reverse_proxy 192.168.1.4:3000
		}
		respond "ip range not allowed"
	}

	# --------------------------------------------------
	# external subdomains without authelia
	#
	#
	#        @ host .wettsten.com
	#        handle @ {
	#                reverse_proxy 192.168.1.
	#        }
	#
	#
	# --------------------------------------------------

	@bitwarden host bitwarden.wettsten.com
	handle @bitwarden {
		reverse_proxy 192.168.1.4:8089
	}

	@giteadocker host gitea-docker.wettsten.com
	handle @giteadocker {
		reverse_proxy 192.168.1.4:3001
	}

	@gitea host gitea.wettsten.com
	handle @gitea {
		reverse_proxy 192.168.1.50:3000
	}

	@jellyfin host jellyfin.wettsten.com
	handle @jellyfin {
		reverse_proxy 192.168.1.42:8096
	}

	# --------------------------------------------------
	# external subdomains with authelia
	#
	#
	#       @ host .wettsten.com
	#       handle @ {
	#               import auth
	#               reverse_proxy 192.168.1.
	#       }
	#        
	#       @ host .wettsten.com
	#       handle @ {
	#	        handle @external {
	#                       import auth
	#               }
	#	reverse_proxy 192.168.1.
	#       }
	#
	# --------------------------------------------------

	@docmost host docmost.wettsten.com
	handle @docmost {
		import auth
		reverse_proxy 192.168.1.4:3300
	}

	@memos host memos.wettsten.com
	handle @memos {
		import auth
		reverse_proxy 192.168.1.4:5230
	}

	@whoami host whoami.wettsten.com
	handle @whoami {
		import auth
		reverse_proxy localhost:80
	}

	@wallos host wallos.wettsten.com
	handle @wallos {
		import auth
		reverse_proxy 192.168.1.4:8389
	}

	@homepage host www.wettsten.com
	handle @homepage {
		import auth
		reverse_proxy 192.168.1.4:3005
	}

	@filebrowser host filebrowser.wettsten.com
	handle @filebrowser {
		import auth
		reverse_proxy 192.168.1.30:8484
	}

	@archive host archive.wettsten.com
	handle @archive {
		import auth
		reverse_proxy 192.168.1.30:8283
	}

	@archivebox host archivebox.wettsten.com
	handle @archivebox {
		import auth
		reverse_proxy 192.168.1.30:8283
	}

	@codeserver host codeserver.wettsten.com
	handle @codeserver {
		import auth
		reverse_proxy 192.168.1.50:3001
	}

	@freshrss host freshrss.wettsten.com
	handle @freshrss {
		import auth
		reverse_proxy 192.168.1.30:8088
	}

	@jackett host jackett.wettsten.com
	handle @jackett {
		import auth
		reverse_proxy 192.168.1.30:9117
	}

	@jdownloader host jdownloader.wettsten.com
	handle @jdownloader {
		import auth
		reverse_proxy 192.168.1.30:5800
	}

	@jellyseerr host jellyseerr.wettsten.com
	handle @jellyseerr {
		import auth
		reverse_proxy 192.168.1.30:5056
	}

	@kavita host kavita.wettsten.com
	handle @kavita {
		import auth
		reverse_proxy 192.168.1.30:5002
	}

	@lidarr host lidarr.wettsten.com
	handle @lidarr {
		import auth
		reverse_proxy 192.168.1.30:8686
	}

	@metube host metube.wettsten.com
	handle @metube {
		import auth
		reverse_proxy 192.168.1.30:8082
	}

	@mstream host mstream.wettsten.com
	handle @mstream {
		import auth
		reverse_proxy 192.168.1.30:3001
	}

	@nzbhydra host nzbhydra.wettsten.com
	handle @nzbhydra {
		import auth
		reverse_proxy 192.168.1.30:5076
	}

	@olivetin host olivetin.wettsten.com
	handle @olivetin {
		import auth
		reverse_proxy 192.168.1.30:1337
	}

	@opengist host opengist.wettsten.com
	handle @opengist {
		import auth
		reverse_proxy 192.168.1.4:6157
	}

	@paperless host paperless.wettsten.com
	handle @paperless {
		import auth
		reverse_proxy 192.168.1.30:8112
	}

	@prowlarr host prowlarr.wettsten.com
	handle @prowlarr {
		import auth
		reverse_proxy 192.168.1.30:9696
	}

	@qbittorrent host qbittorrent.wettsten.com
	handle @qbittorrent {
		import auth
		reverse_proxy 192.168.1.30:8282
	}

	@radarr host radarr.wettsten.com
	handle @radarr {
		import auth
		reverse_proxy 192.168.1.30:7878
	}

	@sabnzbd host sabnzbd.wettsten.com
	handle @sabnzbd {
		import auth
		reverse_proxy 192.168.1.30:8181
	}

	@shlinkweb host shlink.wettsten.com
	handle @shlinkweb {
		import auth
		reverse_proxy 192.168.1.30:8381
	}

	@sonarr host sonarr.wettsten.com
	handle @sonarr {
		import auth
		reverse_proxy 192.168.1.30:8989
	}

	@spdf host spdf.wettsten.com
	handle @spdf {
		import auth
		reverse_proxy 192.168.1.30:8086
	}

	@ittools host it-tools.wettsten.com
	handle @ittools {
		import auth
		reverse_proxy 192.168.1.30:8383
	}

	@wikidocs host wiki.wettsten.com
	handle @wikidocs {
		import auth
		reverse_proxy 192.168.1.30:8022
	}
}