homelab-blueprint/caddy/Caddyfile

{
    admin :2019
}

#### Shared Snippets
(common) {
    tls admin@example.com {
        dns cloudflare {env.CLOUDFLARE_DNS_TOKEN}
        resolvers 1.1.1.1 1.0.0.1
    }
    header {
        # Enable HSTS
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-XSS-Protection 0
        # Prevent browsers from incorrectly detecting non-scripts as scripts and MIME type sniffing
        X-Content-Type-Options nosniff
        Referrer-Policy same-origin
        -Server
        X-Frame-Options "SAMEORIGIN"
        Permissions-Policy "geolocation=(self), microphone=(), camera=(), interest-cohort=()"
        import content-security-general
    }
}

#### Content Security Snippets
(content-security-general) { # Default setup
    # Disable unsafe inline/eval and plugins, only load scripts and stylesheets from same origin, fonts from google,
    #   and images from same origin and imgur. Sites should aim for policies like this.
    Content-Security-Policy "frame-ancestors 'self' https://*.home.example.com"
    #"default-src 'self'; style-src 'self'; script-src 'self'; font-src 'self'; img-src 'self'; form-action 'self'; connect-src 'self'; frame-ancestors 'none';"
    #default-src 'none'; font-src https://fonts.gstatic.com; img-src 'self' https://i.imgur.com; object-src 'none'; script-src 'self'; style-src 'self'
}
(content-security-basic) { # Most basic setup
    # Disable unsafe inline/eval, only load resources from same origin except also allow images from imgur
    # Also disables the execution of plugins
    Content-Security-Policy default-src 'self'; img-src 'self' https://i.imgur.com; object-src 'none'
}
(content-security-api) { # API
    # Disable the loading of any resources and disable framing, recommended for APIs to use
    Content-Security-Policy default-src 'none'; frame-ancestors 'none'
}

#### Infrastructure
dns01.home.example.com {
    import common
    reverse_proxy 10.60.0.5:5380
}

dockhand.home.example.com {
    import common
    reverse_proxy 10.60.0.5:3000
}

nas.home.example.com {
    import common
    reverse_proxy 10.10.0.24:5000
}

# Proxmox Backup Server
pbs.home.example.com {
    import common
    reverse_proxy 10.10.0.8:8007 {
        transport http {
            tls_insecure_skip_verify
        }
        header_up Host {upstream_hostport}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "no-referrer"
    }

    encode gzip
}

# Proxmox
proxmox.home.example.com {
    import common
    reverse_proxy 10.10.0.10:8006 {
        transport http {
            tls_insecure_skip_verify
        }
        header_up Host {upstream_hostport}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "no-referrer"
    }

    encode gzip
}

switchlite8poe.home.example.com {
    import common
    reverse_proxy 10.1.0.5
}

tplink16de.home.example.com {
    import common
    reverse_proxy 10.1.0.8
}

#### Synology Media Stack
bazarr.home.example.com {
    import common
    reverse_proxy 10.10.0.24:6767
}

emby.home.example.com {
    import common
    reverse_proxy 10.10.0.24:8096
}

flaresolverr.home.example.com {
    import common
    reverse_proxy 10.10.0.24:8191
}

gluetun.home.example.com {
    import common
    reverse_proxy 10.10.0.24:8000
}

prowlarr.home.example.com {
    import common
    reverse_proxy 10.10.0.24:9696
}

qbittorrent.home.example.com {
    import common
    reverse_proxy 10.10.0.24:8080
}

radarr.home.example.com {
    import common
    reverse_proxy 10.10.0.24:7878
}

sabnzbd.home.example.com {
    import common
    reverse_proxy 10.10.0.24:8282
}

seerr.home.example.com {
    import common
    reverse_proxy 10.10.0.24:5055
}

sonarr.home.example.com {
    import common
    reverse_proxy 10.10.0.24:8989
}

#### Proxmox Apps
bento-pdf.home.example.com {
    import common
    reverse_proxy 10.10.0.6:8080
}

beszel.home.example.com {
    import common
    reverse_proxy 10.10.0.13:8090
}

gramps.home.example.com {
    import common
    reverse_proxy 10.10.0.17:5000
}

immich.home.example.com {
    import common
    reverse_proxy 10.10.0.15:2283
}

it-tools.home.example.com {
    import common
    reverse_proxy 10.10.0.7:80
}

paperless-ngx.home.example.com {
    import common
    reverse_proxy 10.10.0.11:8000 {
        header_up Host {host}
    }

    encode gzip
}

speedtest.home.example.com {
    import common
    reverse_proxy 10.10.0.16:80
}

ytd.home.example.com {
    import common
    uri strip_prefix metube
    reverse_proxy 10.10.0.14:3033
}