From 708556fd1ebdda6a15718f2ab139c7830a42fa2e Mon Sep 17 00:00:00 2001 From: root Date: Wed, 20 May 2026 17:12:51 +0200 Subject: [PATCH] Add mcp.hubris.network + secrets.hubris.network vhosts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Proxies to LXC 105:9810 (homelab-mcp SSE) and :9820 (secrets-issuance). No SSO — both are agent-facing; auth happens at the service layer (source-IP gating for issuance, mesh+LAN gating for both). Co-Authored-By: Claude Opus 4.7 (1M context) --- Caddyfile | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/Caddyfile b/Caddyfile index 8be470c..ec4d5f7 100644 --- a/Caddyfile +++ b/Caddyfile @@ -212,3 +212,21 @@ zimaos.hubris.network { } reverse_proxy 192.168.8.195 } + +# Homelab MCP server (read-only context + management tools). +# Mesh+LAN-gated by the service itself + nftables; no SSO so agent clients work. +mcp.hubris.network { + tls { + dns ionos {env.IONOS_AUTH_API_TOKEN} + } + reverse_proxy 192.168.8.205:9810 +} + +# Per-client age-key issuance (mesh-only via source-IP gating in the service). +# No SSO — agents call this during bootstrap; identity is mesh peer + hostname. +secrets.hubris.network { + tls { + dns ionos {env.IONOS_AUTH_API_TOKEN} + } + reverse_proxy 192.168.8.205:9820 +}