homelab-blueprint/docker-compose-files/caddy/Caddyfile_template

{
    admin localhost:2019
}

#### Shared Snippets
(common) {
    tls {{CADDY_TLS_EMAIL:-admin@example.com}} {
        dns cloudflare {env.CLOUDFLARE_DNS_TOKEN}
        # DNS-01 must see the public Cloudflare zone, not the internal Technitium split-DNS zone.
        # Exclude the Caddy DMZ host from DNS DNAT so these queries are not redirected to Technitium.
        resolvers 1.1.1.1 1.0.0.1
    }
    header {
        # Enable HSTS
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-XSS-Protection 0
        # Prevent browsers from incorrectly detecting non-scripts as scripts and MIME type sniffing
        X-Content-Type-Options nosniff
        Referrer-Policy same-origin
        -Server
        X-Frame-Options "SAMEORIGIN"
        Permissions-Policy "geolocation=(self), microphone=(), camera=(), interest-cohort=()"
        import content-security-general
    }
}

#### Content Security Snippets
(content-security-general) { # Default setup
    # Disable unsafe inline/eval and plugins, only load scripts and stylesheets from same origin, fonts from google,
    #   and images from same origin and imgur. Sites should aim for policies like this.
    Content-Security-Policy "frame-ancestors 'self' https://*.{{CADDY_BASE_DOMAIN:-home.example.com}}"
    #"default-src 'self'; style-src 'self'; script-src 'self'; font-src 'self'; img-src 'self'; form-action 'self'; connect-src 'self'; frame-ancestors 'none';"
    #default-src 'none'; font-src https://fonts.gstatic.com; img-src 'self' https://i.imgur.com; object-src 'none'; script-src 'self'; style-src 'self'
}
(content-security-basic) { # Most basic setup
    # Disable unsafe inline/eval, only load resources from same origin except also allow images from imgur
    # Also disables the execution of plugins
    Content-Security-Policy default-src 'self'; img-src 'self' https://i.imgur.com; object-src 'none'
}
(content-security-api) { # API
    # Disable the loading of any resources and disable framing, recommended for APIs to use
    Content-Security-Policy default-src 'none'; frame-ancestors 'none'
}

# Shared block for office admin apps with self-signed upstream TLS.
(office-admin-upstream) {
    transport http {
        tls_insecure_skip_verify
    }
    header_up Host {upstream_hostport}
}

# Shared security headers for office admin apps.
(office-admin-security) {
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "no-referrer"
    }
    encode gzip
}

#### Infrastructure
## 1) LAN services
switchlite8poe.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_LAN_PREFIX:-10.0.1}}.6
}

zigbee.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_IOT_PREFIX:-10.0.30}}.5
}

## 2) DNS services
dns01.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{DNS_BIND_IP:-10.0.10.5}}:5380
}

## 3) Office services
nas.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.24:5000
}

# Proxmox Backup Server
pbs.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.8:8007 {
        import office-admin-upstream
    }
    import office-admin-security
}

# Proxmox
proxmox.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.10:8006 {
        import office-admin-upstream
    }
    import office-admin-security
}

#### Arr Stack (LXC 101, 10.0.10.20)
bazarr.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:6767
}

emby.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:8096
}

flaresolverr.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:8191
}

gluetun.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:8000
}

prowlarr.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:9696
}

qbittorrent.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:8080
}

radarr.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:7878
}

sabnzbd.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:8282
}

seerr.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:5055
}

sonarr.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.20:8989
}

#### Home Automation Stack
# Requires in HA configuration.yaml:
#   http:
#     use_x_forwarded_for: true
#     trusted_proxies:
#       - <caddy-host-ip>
ha.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_IOT_PREFIX:-10.0.30}}.6:8123
}

z2m.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_IOT_PREFIX:-10.0.30}}.6:8080
}

#### Proxmox Apps
bento-pdf.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.6:8080
}

beszel.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.13:8090
}

drawio.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    redir / /draw/ 308
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.9:8080
}

gramps.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.17:5000
}

immich.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.15:2283
}

it-tools.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.7:80
}

paperless-ngx.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.11:8000 {
        header_up Host {host}
    }

    encode gzip
}

ytd.{{CADDY_BASE_DOMAIN:-home.example.com}} {
    import common
    uri strip_prefix metube
    reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.14:3033
}