dtoro
c195142827
Authentik-gated (matches paperless.hubris.network's pattern) since the console handles real mutation actions (signal ack/resolve, approval approve/deny) and doesn't implement its own network-level gating the way mcp.hubris.network/secrets.hubris.network do. See dtoro/Homelab-Docs oikos/console/ for the app itself.
317 lines
6.6 KiB
Caddyfile
317 lines
6.6 KiB
Caddyfile
# Internal forward-auth upstream proxy (no TLS between Caddy handlers)
|
|
:8099 {
|
|
@outpost path /outpost.goauthentik.io/*
|
|
reverse_proxy @outpost https://auth.hubris.network:443 {
|
|
transport http {
|
|
tls_server_name auth.hubris.network
|
|
}
|
|
header_up Host auth.hubris.network
|
|
}
|
|
}
|
|
|
|
# Authentik forward-auth snippet (domain-level mode).
|
|
# Usage: add "import authentik" inside any site block to gate it.
|
|
(authentik) {
|
|
route {
|
|
reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network:443
|
|
forward_auth http://127.0.0.1:8099 {
|
|
uri /outpost.goauthentik.io/auth/caddy
|
|
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
|
trusted_proxies private_ranges
|
|
header_up X-Forwarded-Host {host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Forwarded-Uri {uri}
|
|
}
|
|
}
|
|
}
|
|
|
|
# The Caddyfile is an easy way to configure your Caddy web server.
|
|
#
|
|
# Unless the file starts with a global options block, the first
|
|
# uncommented line is always the address of your site.
|
|
#
|
|
# To use your own domain name (with automatic HTTPS), first make
|
|
# sure your domain's A/AAAA DNS records are properly pointed to
|
|
# this machine's public IP, then replace ":80" below with your
|
|
# domain name.
|
|
|
|
media.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
# SSO plugin handles auth via OIDC redirect to Authentik.
|
|
# No forward-auth gate — Jellyfin login page shows SSO button directly.
|
|
reverse_proxy 192.168.8.246:8096
|
|
}
|
|
|
|
git.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
handle_path /_plantuml/* {
|
|
rewrite * /plantuml{uri}
|
|
reverse_proxy 192.168.8.205:8079
|
|
}
|
|
handle {
|
|
reverse_proxy 192.168.8.121:3000
|
|
}
|
|
}
|
|
|
|
paperless.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
@api path /api/*
|
|
handle @api {
|
|
reverse_proxy 192.168.8.130:8000
|
|
}
|
|
handle {
|
|
import authentik
|
|
reverse_proxy 192.168.8.130:8000
|
|
}
|
|
}
|
|
|
|
books.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.247:6060
|
|
}
|
|
|
|
roms.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.249:80
|
|
}
|
|
|
|
home.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.101:8123
|
|
}
|
|
|
|
cloud.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.224:80
|
|
}
|
|
|
|
|
|
proxmox.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy https://192.168.8.77:8006 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
docker.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy https://192.168.8.205:9443 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
jellyseerr.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.245:5056
|
|
}
|
|
|
|
qbit.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
@api path /api/*
|
|
handle @api {
|
|
reverse_proxy 192.168.8.245:8080
|
|
}
|
|
handle {
|
|
import authentik
|
|
reverse_proxy 192.168.8.245:8080
|
|
}
|
|
}
|
|
|
|
sab.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
handle {
|
|
import authentik
|
|
reverse_proxy 192.168.8.245:8082
|
|
}
|
|
}
|
|
|
|
blog.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.205:8080
|
|
}
|
|
|
|
photos.hubris.network {
|
|
# Mulimage 2.0 — PhotoPrism + Go sidecar + SvelteKit (LXC 120)
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
encode zstd gzip
|
|
# PhotoPrism API + static assets + share links
|
|
@pp path /api/v1/* /api/v1 /static/* /share/*
|
|
reverse_proxy @pp 192.168.8.136:2342
|
|
# OIDC hand-off: PhotoPrism redirects to /library/login after SSO;
|
|
# bounce back to / so the SvelteKit SPA picks up the session.
|
|
redir /library / 302
|
|
redir /library/* / 302
|
|
# Go sidecar — marks, folder mutations, duplicates, heap convert
|
|
@sc path /api/sidecar/*
|
|
reverse_proxy @sc 192.168.8.136:8000
|
|
# SvelteKit frontend (catch-all)
|
|
reverse_proxy 192.168.8.136:3000
|
|
}
|
|
|
|
prism.hubris.network {
|
|
# PhotoPrism — direct access for Prismatic mobile client (LXC 120)
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
encode zstd gzip
|
|
reverse_proxy 192.168.8.136:2342
|
|
}
|
|
|
|
auth.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy https://auth.hubris.network:443 {
|
|
transport http {
|
|
tls_server_name auth.hubris.network
|
|
}
|
|
header_up Host auth.hubris.network
|
|
}
|
|
}
|
|
|
|
artifacto.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
# Public paths: share URLs, static assets, health — no SSO
|
|
@public path /p/* /static/* /healthz
|
|
handle @public {
|
|
reverse_proxy 192.168.8.205:3100
|
|
}
|
|
# Admin + login surface: Authentik forward-auth + shared-secret header
|
|
# so the app can auto-login an Authentik-authenticated user.
|
|
handle {
|
|
import authentik
|
|
reverse_proxy 192.168.8.205:3100 {
|
|
header_up X-Artifacto-Gateway {env.ARTIFACTO_GATEWAY_SECRET}
|
|
}
|
|
}
|
|
}
|
|
|
|
plato.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.190:8080
|
|
}
|
|
|
|
zimaos.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.195
|
|
}
|
|
|
|
# Homelab MCP server (read-only context + management tools).
|
|
# Mesh+LAN-gated by the service itself + nftables; no SSO so agent clients work.
|
|
mcp.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.205:9810
|
|
}
|
|
|
|
# Per-client age-key issuance (mesh-only via source-IP gating in the service).
|
|
# No SSO — agents call this during bootstrap; identity is mesh peer + hostname.
|
|
secrets.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.205:9820
|
|
}
|
|
|
|
# Authentik LAN forward-auth outpost (external_host for domain-level providers)
|
|
sso.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy https://auth.hubris.network:443 {
|
|
transport http {
|
|
tls_server_name auth.hubris.network
|
|
}
|
|
header_up Host auth.hubris.network
|
|
}
|
|
}
|
|
|
|
|
|
element.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.242:8080
|
|
}
|
|
|
|
trmnl.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.211:9851
|
|
}
|
|
|
|
house.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.244:3000
|
|
}
|
|
|
|
teddy.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy https://192.168.8.150:8443 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
seanime.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
reverse_proxy 192.168.8.248:43211
|
|
}
|
|
|
|
oikos.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
handle {
|
|
import authentik
|
|
reverse_proxy 192.168.8.205:8091
|
|
}
|
|
}
|