KonradHerman
71 lines
2.1 KiB
Plaintext
71 lines
2.1 KiB
Plaintext
# Global options
|
|
{
|
|
auto_https disable_redirects
|
|
email k.radikal@gmail.com
|
|
}
|
|
|
|
# Consolidated wildcard site block
|
|
*.klhoud.com, http://*.klhoud.com {
|
|
# Automatic HTTPS via DNS challenge for all subdomains
|
|
tls {
|
|
dns cloudflare {$CLOUDFLARE_API_TOKEN}
|
|
}
|
|
|
|
# Proxmox
|
|
@proxmox host proxmox.klhoud.com
|
|
handle @proxmox {
|
|
reverse_proxy https://192.168.0.112:8006 {
|
|
# Required for connecting to Proxmox's self-signed/untrusted certificate
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
versions 1.1
|
|
}
|
|
}
|
|
}
|
|
|
|
# AdGuard Home
|
|
@adguard host adguard.klhoud.com
|
|
handle @adguard {
|
|
reverse_proxy 192.168.0.170:80
|
|
}
|
|
|
|
# Dockge
|
|
@dockge host dockge.klhoud.com
|
|
handle @dockge {
|
|
reverse_proxy 192.168.0.12:5001
|
|
}
|
|
|
|
# Nextcloud
|
|
@cloud host cloud.klhoud.com
|
|
handle @cloud {
|
|
reverse_proxy 192.168.0.12:8080
|
|
# Nextcloud-specific headers
|
|
header Strict-Transport-Security "max-age=31536000;"
|
|
|
|
# Handle large file uploads
|
|
request_body {
|
|
max_size 10GB
|
|
}
|
|
}
|
|
|
|
# Coolify (control plane runs on LXC 103). Upstream HTTPS to 443 because
|
|
# coolify-proxy's HTTP entry forces a redirect-to-https which would loop
|
|
# back through us. HTTPS upstream hits the no-redirect routes; cert is
|
|
# self-signed since coolify-proxy's ACME for coolify.klhoud.com fails
|
|
# (DNS points at us, not it), so we skip verify.
|
|
# coolify-proxy (Traefik) on LXC 103 listens on :80. We added a custom
|
|
# higher-priority router in /data/coolify/proxy/dynamic/coolify-noredirect.yaml
|
|
# there to bypass Coolify's auto-generated http->https redirect (which would
|
|
# loop us). WebSocket routes (/app, /terminal/ws) work natively on :80.
|
|
@coolify host coolify.klhoud.com
|
|
handle @coolify {
|
|
reverse_proxy 192.168.0.47:80
|
|
}
|
|
|
|
# IMPORTANT: Fallback Handler
|
|
# This prevents non-matching requests from falling through and failing.
|
|
handle {
|
|
respond "Not Found" 404
|
|
}
|
|
}
|