tocluster

Caddyfile

@@ -1,7 +1,17 @@
 {
 	email {$ACME_EMAIL}
 }
-git.{$DOMENESHOP_DNS} {
+### FUNKSJONER ###
+(remote-ip) {
+	@internal remote_ip 10.10.10.0/24 127.0.0.1/8
+	@external remote_ip 0.0.0.0/0
+}
+(common-auth) {
+	basicauth {
+		tvh $2a$14$9nNDlR6oYiSIX7ENnel.E.pezV8LQpHS3hhzhglXwijMFwgEYMAq2
+	}
+}
+(rate-limit) {
 	rate_limit {
 		zone git_zone {
 			key {remote_host}
@@ -9,15 +19,25 @@ git.{$DOMENESHOP_DNS} {
 			window 10s
 		}
 	}
+}
+(read-only) {
+	@readonly {
+		method POST PUT DELETE PATCH
+	}
+	respond @readonly 403
+}
+### TJENESTER ###
+git.{$DOMENESHOP_DNS} {
+	import remote-ip
+	handle @external {
+		import rate-limit
 		reverse_proxy gitea:3000
+	}
 }
 lms.home.{$DOMENESHOP_DNS}  {
 	tls internal
-    @internal remote_ip 10.10.10.0/24 127.0.0.1/8
+	import remote-ip
 	handle @internal {
-        basicauth {
-            tvh $2a$14$9nNDlR6oYiSIX7ENnel.E.pezV8LQpHS3hhzhglXwijMFwgEYMAq2
-        }
 		reverse_proxy lms:9000        
 	}
 	respond "Forbidden" 403
@@ -25,11 +45,36 @@ lms.home.{$DOMENESHOP_DNS}  {
 
 pihole.home.{$DOMENESHOP_DNS} {
 	tls internal
+	import remote-ip
+	handle @internal {
 		redir / /admin
 		reverse_proxy pihole:80
-    respond "Forbidden" 403
+	}
 }
 nextcloud.{$DOMENESHOP_DNS}  {
+	import remote-ip
+	handle @external {
+		import rate-limit
 		encode gzip zstd
 		reverse_proxy nextcloud-app:80
+	}
 }
+portainer.{$DOMENESHOP_DNS} {
+	import remote-ip
+	handle @external {
+		import common-auth
+		import rate-limit
+		import read-only
+		reverse_proxy portainer:9000
+	}
+	respond "Forbidden" 403
+}
+portainer.home.{$DOMENESHOP_DNS} {
+	import remote-ip
+	handle @internal {
+		reverse_proxy portainer:9000
+	}
+        respond "Forbidden" 403
+}
+
+

Caddyfile.save

@@ -0,0 +1,87 @@
+{
+	email {$ACME_EMAIL}
+}
+(remote-ip) {
+	@internal remote_ip 10.10.10.0/24 127.0.0.1/8
+	@external remote_ip 0.0.0.0/0
+}
+(common-auth) {
+	basicauth {
+		tvh $2a$14$9nNDlR6oYiSIX7ENnel.E.pezV8LQpHS3hhzhglXwijMFwgEYMAq2
+	}
+}
+(rate-limit) {
+	rate_limit {
+		zone git_zone {
+			key {remote_host}
+			events 30
+			window 10s
+		}
+	}
+}
+(read-only) {
+	@readonly {
+		method POST PUT DELETE PATCH
+	}
+	respond @readonly 403
+	
+	# whitelist login/logout
+	@auth_ok {
+		path /api/auth/*
+	}
+	respond @readonly 403 {
+		not path /api/auth/*
+	}
+}
+git.{$DOMENESHOP_DNS} {
+	import remote-ip
+	handle @external {
+		import rate-limit
+		reverse_proxy gitea:3000
+	}
+}
+lms.home.{$DOMENESHOP_DNS}  {
+	tls internal
+	import remote-ip
+	handle @internal {
+		import common-auth
+		reverse_proxy lms:9000        
+	}
+	respond "Forbidden" 403
+}
+
+pihole.home.{$DOMENESHOP_DNS} {
+	tls internal
+	import remote-ip
+	import common-auth 
+	handle @internal {
+		redir / /admin
+		reverse_proxy pihole:80
+	}
+}
+nextcloud.{$DOMENESHOP_DNS}  {
+	import remote-ip
+	handle @external {
+		encode gzip zstd
+		reverse_proxy nextcloud-app:80
+	}
+}
+portainer.{$DOMENESHOP_DNS} {
+	import rate-limit
+	import remote-ip
+	handle @external {
+		import common-auth
+		import read-only
+		reverse_proxy portainer:9000
+	}
+	respond "Forbidden" 403
+}
+portainer.home.{$DOMENESHOP_DNS} {
+	import remote-ip
+	handle @internal {
+		reverse_proxy portainer:9000
+	}
+        respond "Forbidden" 403
+}
+
+

docker-compose.yaml

@@ -15,12 +15,15 @@ services:
     networks:
       - proxy_net
       - edge_net
+      - proxy_swarm
 
 networks:
   proxy_net:
     external: true
   edge_net:
     external: true
+  proxy_swarm:
+    external: true
 
 volumes:
   caddy_data: