{
  email simon@renoux.dev

	metrics {
		per_host
	}
}

(logging) {
    log {
        output file /var/log/caddy/{args[0]}.log
        format console
        # level error
    }
}

@local_net client_ip 172.16.0.0/12
@admin_net client_ip 172.16.10.0/24
@server_net client_ip 172.16.20.0/24
@admin_vpn_net client_ip 172.16.30.0/24
@guest_net client_ip 172.16.100.0/24

rack.renoux.dev {
  respond "yup, this is a rack!"
}

# Communication
matrix.fantomitechno.dev {
  import logging matrix
  reverse_proxy 127.0.0.1:2000
}

livekit.fantomitechno.dev {
  import logging livekit
  # for lk-jwt-service
  @lk-jwt-service path /sfu/get* /healthz* /get_token*
  route @lk-jwt-service {
    reverse_proxy 127.0.0.1:2001
  }

  # for livekit
  reverse_proxy 127.0.0.1:2002
}

pds.fantomitechno.dev {
  import logging pds
  reverse_proxy 127.0.0.1:2010
}

# Storage
knot.fantomitechno.dev {
  import logging knot
  reverse_proxy 127.0.0.1:4000
}

spindle.fantomitechno.dev {
  import logging spindle
  reverse_proxy 127.0.0.1:4001
}

git.fantomitechno.dev {
  import logging gitea
  reverse_proxy not @local_net 127.0.0.1:4006 {
    header_up X-Real-Ip {remote_host}
  }

  reverse_proxy @local_net 127.0.0.1:4005 {
    header_up X-Real-Ip {remote_host}
  }
}

hold.fantomitechno.dev {
  import logging hold
  reverse_proxy 127.0.0.1:4010
}

drive.renoux.dev, drive.s.renoux.dev {
  import logging cryptpad

  handle /cryptpad_websocket* {
    reverse_proxy 127.0.0.1:4021
  }

  handle {
    reverse_proxy 127.0.0.1:44020
  }
}

files.fantomitechno.dev {
  import logging copyparty
  reverse_proxy 127.0.0.1:4020
}

kiwix.fantomitechno.dev, kiwix.renoux.dev {
  import logging kiwix
  reverse_proxy 127.0.0.1:4030
}

wikipedia.renoux.dev {
  redir https://kiwix.renoux.dev/viewer#wikipedia_en_all_maxi_2026-02{uri}
}

photo.renoux.dev {
  import logging immich
  reverse_proxy 127.0.0.1:4040
}

vault.renoux.dev {
  import logging vaultwarden
  reverse_proxy 127.0.0.1:4050
}

pdf.fantom.home {
  import logging paperless
  abort not @local_net
  reverse_proxy 127.0.0.1:4060
  tls internal
}

notes.fantomitechno.dev {
  import logging affine
  reverse_proxy 127.0.0.1:4070
}

graph.fantom.home {
  import logging grafana
  abort not @local_net
  reverse_proxy 127.0.0.1:3000
  tls internal
}

mastodon.fantomitechno.dev {
  import logging mastodon
  
  root * /var/mastodon/public

	encode gzip

  @static file

  handle @static {
    file_server
  }

  handle /api/v1/streaming* {
    reverse_proxy mastodon-streaming:4000
  }

  handle {
    reverse_proxy mastodon-web:3000
  }

  header {
    Strict-Transport-Security "max-age=31536000;"
  }

  header /sw.js  Cache-Control "public, max-age=0";
  header /emoji* Cache-Control "public, max-age=31536000, immutable"
  header /packs* Cache-Control "public, max-age=31536000, immutable"
  header /system/accounts/avatars* Cache-Control "public, max-age=31536000, immutable"
  header /system/media_attachments/files* Cache-Control "public, max-age=31536000, immutable"

  handle_errors {
    @5xx expression `{http.error.status_code} >= 500 && {http.error.status_code} < 600`
    rewrite @5xx /500.html
    file_server
  }
}

jellyfin.fantom.home {
  import logging jellyfin
  abort not @local_net
  reverse_proxy 127.0.0.1:4080
  tls internal
}

music.fantom.home {
  import logging jellyfin
  abort not @local_net
  reverse_proxy 127.0.0.1:4085
  tls internal
}

torrent.fantom.home {
  import logging qbittorrent
  abort not @local_net
  reverse_proxy 127.0.0.1:4090
  tls internal
}

flaresolver.fantom.home {
  import logging flaresolver
  abort not @local_net
  reverse_proxy 127.0.0.1:4091
  tls internal
}

prowlarr.fantom.home {
  import logging prowlarr
  abort not @local_net
  reverse_proxy 127.0.0.1:4092
  tls internal
}

jackett.fantom.home {
  import logging jackett
  abort not @local_net
  reverse_proxy 127.0.0.1:4093
  tls internal
}

sonarr.fantom.home {
  import logging sonarr
  abort not @local_net
  reverse_proxy 127.0.0.1:4094
  tls internal
}

radarr.fantom.home {
  import logging radarr
  abort not @local_net
  reverse_proxy 127.0.0.1:4095
  tls internal
}

bazarr.fantom.home {
  import logging bazarr
  abort not @local_net
  reverse_proxy 127.0.0.1:4096
  tls internal
}