113 lines
3.6 KiB
Caddyfile
113 lines
3.6 KiB
Caddyfile
# ── Global options ─────────────────────────────────────────────────────────────
|
|
{
|
|
debug
|
|
}
|
|
|
|
# ── Snippets reutilizables ─────────────────────────────────────────────────────
|
|
(security_headers) {
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
-Server
|
|
}
|
|
}
|
|
|
|
(internal_only) {
|
|
basic_auth {
|
|
carlos $2a$14$6MgHKR/jLD..MFkuNo0i1OBs.wwZOntIDiYsYpsyyH./OCKa8SoGS
|
|
}
|
|
@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32
|
|
abort @blocked
|
|
}
|
|
|
|
# ── Main site ──────────────────────────────────────────────────────────────────
|
|
carloselugo.com, www.carloselugo.com {
|
|
reverse_proxy frontend:80
|
|
import security_headers
|
|
encode gzip
|
|
log {
|
|
output file /var/log/caddy/access.log
|
|
format json
|
|
}
|
|
}
|
|
|
|
# ── Uptime Kuma ────────────────────────────────────────────────────────────────
|
|
uptime.carloselugo.com {
|
|
import internal_only
|
|
import security_headers
|
|
reverse_proxy uptime-kuma:3001
|
|
encode gzip
|
|
log {
|
|
output file /var/log/caddy/uptime.log
|
|
format json
|
|
}
|
|
}
|
|
|
|
# ── Netdata — protegido, info sensible ────────────────────────────────────────
|
|
metrics.carloselugo.com {
|
|
import internal_only
|
|
import security_headers
|
|
header X-Frame-Options "SAMEORIGIN"
|
|
reverse_proxy netdata:19999
|
|
encode gzip
|
|
log {
|
|
output file /var/log/caddy/metrics.log
|
|
format json
|
|
}
|
|
}
|
|
|
|
# ── Umami Analytics ───────────────────────────────────────────────────────────
|
|
analytics.carloselugo.com {
|
|
import security_headers
|
|
encode gzip
|
|
log {
|
|
output file /var/log/caddy/analytics.log
|
|
format json
|
|
}
|
|
|
|
@public path /script.js /api/send
|
|
handle @public {
|
|
reverse_proxy umami:3000
|
|
}
|
|
|
|
handle {
|
|
@blocked not remote_ip 24.139.235.46/32 192.168.68.0/24 2605:ba00:3108::/48 74.115.203.2/32
|
|
abort @blocked
|
|
reverse_proxy umami:3000
|
|
}
|
|
}
|
|
|
|
# ── ntfy (notificaciones push) ────────────────────────────────────────────────
|
|
ntfy.carloselugo.com {
|
|
reverse_proxy ntfy:80 {
|
|
# ntfy usa SSE (Server-Sent Events) para push en tiempo real.
|
|
# Sin esto, las notificaciones no llegan al celular.
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
# ── Gitea (git) ───────────────────────────────────────────────────────────────
|
|
git.carloselugo.com {
|
|
import security_headers
|
|
reverse_proxy gitea:3000
|
|
encode gzip
|
|
log {
|
|
output file /var/log/caddy/gitea.log
|
|
format json
|
|
}
|
|
}
|
|
|
|
# ── Dozzle (logs de containers) — protegido ───────────────────────────────────
|
|
logs.carloselugo.com {
|
|
import internal_only
|
|
import security_headers
|
|
reverse_proxy dozzle:8080
|
|
encode gzip
|
|
log {
|
|
output file /var/log/caddy/dozzle.log
|
|
format json
|
|
}
|
|
}
|