Initial commit — docker stack carloselugo.com

Services: Caddy, frontend, Uptime Kuma, Netdata, ntfy, Dozzle, Gitea
2026-04-23 18:57:20 +00:00
commit f510bec447
19 changed files with 1238 additions and 0 deletions
@@ -0,0 +1,112 @@
+# ── Global options ─────────────────────────────────────────────────────────────
+{
+	debug
+}
+
+# ── Snippets reutilizables ─────────────────────────────────────────────────────
+(security_headers) {
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "DENY"
+		Referrer-Policy "strict-origin-when-cross-origin"
+		-Server
+	}
+}
+
+(internal_only) {
+	basic_auth {
+		carlos $2a$14$6MgHKR/jLD..MFkuNo0i1OBs.wwZOntIDiYsYpsyyH./OCKa8SoGS
+	}
+	@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32
+	abort @blocked
+}
+
+# ── Main site ──────────────────────────────────────────────────────────────────
+carloselugo.com, www.carloselugo.com {
+	reverse_proxy frontend:80
+	import security_headers
+	encode gzip
+	log {
+		output file /var/log/caddy/access.log
+		format json
+	}
+}
+
+# ── Uptime Kuma ────────────────────────────────────────────────────────────────
+uptime.carloselugo.com {
+	import internal_only
+	import security_headers
+	reverse_proxy uptime-kuma:3001
+	encode gzip
+	log {
+		output file /var/log/caddy/uptime.log
+		format json
+	}
+}
+
+# ── Netdata — protegido, info sensible ────────────────────────────────────────
+metrics.carloselugo.com {
+	import internal_only
+	import security_headers
+	header X-Frame-Options "SAMEORIGIN"
+	reverse_proxy netdata:19999
+	encode gzip
+	log {
+		output file /var/log/caddy/metrics.log
+		format json
+	}
+}
+
+# ── Umami Analytics ───────────────────────────────────────────────────────────
+analytics.carloselugo.com {
+	import security_headers
+	encode gzip
+	log {
+		output file /var/log/caddy/analytics.log
+		format json
+	}
+
+	@public path /script.js /api/send
+	handle @public {
+		reverse_proxy umami:3000
+	}
+
+	handle {
+		@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32
+		abort @blocked
+		reverse_proxy umami:3000
+	}
+}
+
+# ── ntfy (notificaciones push) ────────────────────────────────────────────────
+ntfy.carloselugo.com {
+	reverse_proxy ntfy:80 {
+		# ntfy usa SSE (Server-Sent Events) para push en tiempo real.
+		# Sin esto, las notificaciones no llegan al celular.
+		flush_interval -1
+	}
+}
+
+# ── Gitea (git) ───────────────────────────────────────────────────────────────
+git.carloselugo.com {
+	import security_headers
+	reverse_proxy gitea:3000
+	encode gzip
+	log {
+		output file /var/log/caddy/gitea.log
+		format json
+	}
+}
+
+# ── Dozzle (logs de containers) — protegido ───────────────────────────────────
+logs.carloselugo.com {
+	import internal_only
+	import security_headers
+	reverse_proxy dozzle:8080
+	encode gzip
+	log {
+		output file /var/log/caddy/dozzle.log
+		format json
+	}
+}