From 2b8bddc488b0a4acd87fecbd070a16cb6f4153c3 Mon Sep 17 00:00:00 2001
From: root <root@caddy.fritz.box>
Date: Wed, 12 Aug 2026 14:33:03 +0200
Subject: [PATCH] split: move 10 strong-hosted services to dedicated Caddy on
 CT 140 (.250)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Moved media, books, roms, jellyseerr, qbit, sab, matrix, element,
house, seanime to strong Caddy (192.168.8.250). These services
backends live on strong LXCs — co-locating Caddy removes cross-host
proxy dependency.

Remaining on hubris (.175): git, mcp, oikos, paperless, cloud, photos,
proxmox, secrets, home, trmnl, auth.
---
 Caddyfile | 72 -------------------------------------------------------
 1 file changed, 72 deletions(-)

diff --git a/Caddyfile b/Caddyfile
index 520e43b..e1e7054 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -35,14 +35,6 @@
 # this machine's public IP, then replace ":80" below with your
 # domain name.
 
-media.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	# SSO plugin handles auth via OIDC redirect to Authentik.
-	# No forward-auth gate — Jellyfin login page shows SSO button directly.
-	reverse_proxy 192.168.8.246:8096
-}
 
 git.hubris.network {
 	tls {
@@ -71,19 +63,7 @@ paperless.hubris.network {
 	}
 }
 
-books.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.247:6060
-}
 
-roms.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.249:80
-}
 pascal.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
@@ -128,36 +108,8 @@ docker.hubris.network {
 	}
 }
 
-jellyseerr.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.245:5056
-}
 
-qbit.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	@api path /api/*
-	handle @api {
-		reverse_proxy 192.168.8.245:8080
-	}
-	handle {
-		import authentik
-		reverse_proxy 192.168.8.245:8080
-	}
-}
 
-sab.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	handle {
-		import authentik
-		reverse_proxy 192.168.8.245:8082
-	}
-}
 
 blog.hubris.network {
 	tls {
@@ -257,19 +209,7 @@ sso.hubris.network {
 
 # Matrix Synapse federation + client API.
 # No authentik gate — Synapse handles its own auth.
-matrix.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.242:8008
-}
 
-element.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.242:8080
-}
 
 trmnl.hubris.network {
 	tls {
@@ -278,12 +218,6 @@ trmnl.hubris.network {
 	reverse_proxy 192.168.8.211:9851
 }
 
-house.hubris.network {
-tls {
-dns ionos {env.IONOS_AUTH_API_TOKEN}
-}
-reverse_proxy 192.168.8.244:3000
-}
 
 teddy.hubris.network {
 	tls {
@@ -296,12 +230,6 @@ teddy.hubris.network {
 	}
 }
 
-seanime.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.248:43211
-}
 
 # ─── Oikos (Go rewrite, Docker on mac-mini) ───
 # Phase 6 cutover — replaces apps/105 Python MCP + console.