first commit

roles/caddy/templates/Caddyfile.j2

@@ -0,0 +1,84 @@
+(cloudflare) {
+  tls {
+    dns cloudflare {{ opnsense_caddy_cloudflare_api_token }}
+    resolvers 1.1.1.1
+  }
+}
+
+(headers) {
+  header {
+    Permissions-Policy interest-cohort=()
+    Strict-Transport-Security "max-age=31536000; includeSubdomains"
+    X-XSS-Protection "1; mode=block"
+    X-Content-Type-Options "nosniff"
+    X-Robots-Tag noindex, nofollow
+    Referrer-Policy "same-origin"
+    Content-Security-Policy "frame-ancestors {{ domain_base }} *.{{ domain_base }}"
+    -Server
+    Permissions-Policy "geolocation=(self {{ domain_base }} *.{{ domain_base }}), microphone=()"
+  }
+}
+
+## core
+
+#neo
+neo.{{ domain_base }} {
+  reverse_proxy https://10.56.0.1:8006 {
+    transport http {
+      tls_insecure_skip_verify
+    }
+  }
+  import cloudflare
+}
+
+# pihole
+dns.{{ domain_base }} {
+  redir / /admin
+  reverse_proxy http://10.56.0.253
+  import cloudflare
+}
+
+# # dhcp
+# dhcp.{{ domain_base }} {
+#   redir / /dhcp.leases
+#   reverse_proxy http://10.56.0.253:81
+#   import cloudflare
+# }
+
+# opnsense
+opnsense.{{ domain_base }} {
+  reverse_proxy https://10.56.0.254:8443 {
+    transport http {
+      tls_insecure_skip_verify
+    }
+  }
+  import cloudflare
+}
+
+# pain ipmi
+ipmi.{{ domain_base }} {
+  reverse_proxy https://10.56.0.20 {
+    transport http {
+      tls_insecure_skip_verify
+    }
+  }
+  import cloudflare
+}
+
+## pikvm
+#kvm.{{ domain_base }} {
+#  reverse_proxy https://10.56.0.100:443 {
+#    transport http {
+#      tls_insecure_skip_verify
+#    }
+#  }
+#  import cloudflare
+#}
+
+# uptime-kuma
+kuma.{{ domain_base }} {
+  reverse_proxy http://10.56.0.247:3001
+  import cloudflare
+}
+
+

roles/caddy/templates/caddy.service.j2

@@ -0,0 +1,37 @@
+# caddy.service
+#
+# For using Caddy with a config file.
+#
+# Make sure the ExecStart and ExecReload commands are correct
+# for your installation.
+#
+# See https://caddyserver.com/docs/install for instructions.
+#
+# WARNING: This service does not use the --resume flag, so if you
+# use the API to make changes, they will be overwritten by the
+# Caddyfile next time the service is restarted. If you intend to
+# use Caddy's API to configure it, add the --resume flag to the
+# `caddy run` command or use the caddy-api.service file instead.
+
+[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStart=/usr/local/bin/caddy run --environ --config /etc/caddy/Caddyfile
+ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+LimitNPROC=512
+PrivateDevices=yes
+PrivateTmp=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target