Skip to content

Commit 4c9f03c

Browse files
author
Tom Softreck
committed
caddy multiservice with caddy embedded on docker
1 parent 23cbdc7 commit 4c9f03c

File tree

23 files changed

+1630
-145
lines changed

23 files changed

+1630
-145
lines changed

‎caddy-demo/1-caddyfile/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,4 +66,4 @@ This project demonstrates a simple static website served by Caddy using a Caddyf
6666

6767
## License
6868

69-
MIT
69+
Apache 2

‎caddy-demo/2-docker-labels/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,4 +90,4 @@ If ports 80/443 are in use:
9090
9191
## License
9292
93-
MIT
93+
Apache 2

‎caddy-demo/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,4 +115,4 @@ If you get port conflicts (80 or 443 already in use):
115115

116116
## License
117117

118-
MIT
118+
Apache 2

‎caddy2/.env.example‎

Lines changed: 83 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,92 @@
1-
# Domain configuration
1+
# ============================================
2+
# Caddy Reverse Proxy Configuration
3+
# ============================================
4+
5+
# --------------------------------
6+
# Domain & Network Configuration
7+
# --------------------------------
8+
# Base domain for all services
29
DOMAIN=lvh.me
310

11+
# Ports to expose (set to empty to disable HTTP)
12+
HTTP_PORT=80
13+
HTTPS_PORT=443
14+
15+
# Docker network configuration
16+
NETWORK_NAME=caddy_network
17+
NETWORK_DRIVER=bridge
18+
19+
# --------------------------------
20+
# Service Configuration
21+
# --------------------------------
22+
# API Service
23+
API_SUBDOMAIN=api
24+
API_PORT=8080
25+
26+
# Web Application
27+
WEB_SUBDOMAIN=app
28+
WEB_PORT=8081
29+
30+
# Authentication Service
31+
AUTH_SUBDOMAIN=auth
32+
AUTH_PORT=8082
33+
34+
# --------------------------------
35+
# SSL/TLS Configuration
36+
# --------------------------------
37+
# Set to 'true' to disable HTTPS (not recommended)
38+
DISABLE_HTTPS=false
39+
40+
# Set to 'true' to use Let's Encrypt staging (avoids rate limits)
41+
STAGING=false
42+
43+
# Email for Let's Encrypt notifications
44+
EMAIL=[email protected]
445

546
# Cloudflare API Token (required for DNS-01 challenge)
647
# Create one at: https://dash.cloudflare.com/profile/api-tokens
748
# Required permissions: Zone.Zone:Read, Zone.DNS:Edit
849
CF_API_TOKEN=your_cloudflare_api_token_here
950

10-
# Subdomains for services
11-
API_SUBDOMAIN=api
12-
WEB_SUBDOMAIN=app
13-
AUTH_SUBDOMAIN=auth
51+
# --------------------------------
52+
# Container Configuration
53+
# --------------------------------
54+
# Caddy version
55+
CADDY_IMAGE=lucaslorentz/caddy-docker-proxy:latest
56+
57+
# Resource limits
58+
CADDY_CPUS=1
59+
CADDY_MEMORY=512M
60+
61+
# --------------------------------
62+
# Logging & Monitoring
63+
# --------------------------------
64+
# Log level (debug, info, warn, error, panic, fatal)
65+
LOG_LEVEL=info
66+
67+
# Enable/disable access logs
68+
ENABLE_ACCESS_LOGS=true
69+
70+
# --------------------------------
71+
# Security
72+
# --------------------------------
73+
# Basic Auth (username:hashed_password)
74+
# Generate with: caddy hash-password --plaintext 'yourpassword'
75+
# BASIC_AUTH_USER=admin
76+
# BASIC_AUTH_HASH=your_hashed_password_here
77+
78+
# IP Whitelist (comma-separated)
79+
# ALLOWED_IPS=192.168.1.0/24,10.0.0.1
80+
81+
# --------------------------------
82+
# Development Settings
83+
# --------------------------------
84+
# Set to 'true' to enable development mode (disables some security features)
85+
DEV_MODE=false
86+
87+
# Additional domains for development
88+
EXTRA_DOMAINS=test.local,*.test.local
1489

15-
# Email for Let's Encrypt notifications (optional but recommended)
16-
# [email protected]
90+
# ============================================
91+
# End of Configuration
92+
# ============================================

‎caddy2/Caddyfile‎

Lines changed: 128 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,143 @@
1+
# Global settings
12
{
2-
debug
3-
}
3+
# Log level from environment variable
4+
log {
5+
level {env.LOG_LEVEL}
6+
output file /var/log/caddy/access.log {
7+
roll_size 10MiB
8+
roll_keep 5
9+
roll_keep_for 24h
10+
}
11+
}
412

5-
:80 {
6-
redir https://{host}{uri} permanent
13+
# Enable the admin API endpoint
14+
admin off
15+
16+
# Enable automatic HTTPS
17+
auto_https disable_redirects
18+
email {env.EMAIL}
19+
20+
# Enable the HTTP/3
21+
servers {
22+
protocol {
23+
experimental_http3
24+
}
25+
}
726
}
827

9-
:443 {
10-
tls /etc/caddy/certs/localhost.crt /etc/caddy/certs/localhost.key
28+
# Redirect HTTP to HTTPS if not disabled
29+
{env.HTTP_PORT}:{
30+
@http {
31+
protocol http
32+
}
33+
redir @http https://{host}{uri} permanent
34+
}
1135

36+
# Main HTTPS server
37+
{env.HTTPS_PORT}:{
38+
# TLS configuration
39+
tls {
40+
issuer acme {
41+
email {env.EMAIL}
42+
dns cloudflare {env.CF_API_TOKEN}
43+
resolvers 1.1.1.1
44+
}
45+
46+
# Use staging for testing to avoid rate limits
47+
{$STAGING}
48+
49+
# Use local certificates in development
50+
{$DEV_MODE} {
51+
issuer self_signed
52+
}
53+
}
54+
55+
# Security headers
56+
header {
57+
# Enable HSTS (1 year)
58+
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
59+
60+
# Prevent clickjacking
61+
X-Frame-Options "DENY"
62+
63+
# Enable XSS protection
64+
X-XSS-Protection "1; mode=block"
65+
66+
# Prevent MIME type sniffing
67+
X-Content-Type-Options "nosniff"
68+
69+
# Referrer policy
70+
Referrer-Policy "strict-origin-when-cross-origin"
71+
72+
# Content Security Policy
73+
# Modify this according to your application's needs
74+
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'"
75+
76+
# Remove server header
77+
-Server
78+
}
79+
80+
# Logging
81+
log {
82+
output file /var/log/caddy/access.log {
83+
roll_size 10MiB
84+
roll_keep 5
85+
roll_keep_for 24h
86+
}
87+
}
88+
1289
# API service
13-
@api host api.lvh.me
90+
@api {
91+
host api.{env.DOMAIN}
92+
}
1493
handle @api {
15-
reverse_proxy api:80
94+
reverse_proxy api:${API_PORT}
95+
96+
# Rate limiting
97+
@login {
98+
path /login
99+
method POST
100+
}
101+
102+
route @login {
103+
rate_limit 10/1m 50
104+
reverse_proxy api:${API_PORT}
105+
}
106+
}
107+
108+
# Web application
109+
@web {
110+
host app.{env.DOMAIN}
16111
}
17-
18-
# Web service
19-
@web host app.lvh.me
20112
handle @web {
21-
reverse_proxy web:80
113+
root * /srv
114+
file_server browse
115+
try_files {path} /index.html
116+
}
117+
118+
# Authentication service
119+
@auth {
120+
host auth.{env.DOMAIN}
22121
}
23-
24-
# Auth service
25-
@auth host auth.lvh.me
26122
handle @auth {
27-
reverse_proxy auth:80
123+
reverse_proxy auth:${AUTH_PORT}
124+
}
125+
126+
# Default response for undefined hosts
127+
@notfound {
128+
not host {env.DOMAIN} {env.API_SUBDOMAIN}.{env.DOMAIN} {env.WEB_SUBDOMAIN}.{env.DOMAIN} {env.AUTH_SUBDOMAIN}.{env.DOMAIN}
28129
}
130+
respond @notfound "Service not found" 404
131+
132+
# Health check endpoint
133+
handle /healthz {
134+
respond "OK" 200
135+
}
136+
}
29137

30-
# Domyślna odpowiedź
31-
handle {
32-
respond "Nie znaleziono serwisu dla {host}" 404
138+
# Debug endpoint (only in development)
139+
{$DEV_MODE} {
140+
handle /debug/* {
141+
respond "Debug information" 200
33142
}
34143
}

0 commit comments

Comments
 (0)