Erich Blume
66badfafd1
All checks were successful
Build Container / build (push) Successful in 13s
## Summary - Add Caddy reverse proxy routes for all k8s services (grafana, argocd, prometheus, loki, miniflux, devpi, kiwix, torrent, teslamate) - Add PostgreSQL via Caddy L4 TCP proxy on port 5432 - Caddy proxies to existing Tailscale endpoints - traffic stays local on indri - Both `*.ops.eblu.me` and `*.tail8d86e.ts.net` URLs continue to work ## Updated References - Alloy: prometheus/loki push endpoints → `*.ops.eblu.me` - Borgmatic: PostgreSQL backup host → `pg.ops.eblu.me` - Devpi: DEVPI_OUTSIDE_URL → `pypi.ops.eblu.me` - indri-services-check: health check URLs - CLAUDE.md: argocd login command ## Deployment and Testing - [ ] Run `mise run provision-indri -- --tags caddy` to deploy new Caddy config - [ ] Test HTTP services: `curl https://grafana.ops.eblu.me/api/health` - [ ] Test PostgreSQL: `pg_isready -h pg.ops.eblu.me -p 5432` - [ ] Run `mise run provision-indri -- --tags alloy` to update Alloy endpoints - [ ] Run `mise run provision-indri -- --tags borgmatic` to update borgmatic - [ ] Sync devpi in ArgoCD: `argocd app sync devpi` - [ ] Re-login to ArgoCD: `argocd login argocd.ops.eblu.me ...` - [ ] Run `mise run indri-services-check` to verify all services 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/59
68 lines
2.2 KiB
YAML
68 lines
2.2 KiB
YAML
---
|
|
# Caddy reverse proxy configuration
|
|
# Caddy is built manually from ~/code/3rd/caddy with the Gandi DNS plugin
|
|
|
|
caddy_repo_dir: /Users/erichblume/code/3rd/caddy
|
|
caddy_binary: "{{ caddy_repo_dir }}/bin/caddy"
|
|
caddy_config_dir: /Users/erichblume/.config/caddy
|
|
caddy_data_dir: /Users/erichblume/.local/share/caddy
|
|
caddy_log_dir: /Users/erichblume/Library/Logs
|
|
|
|
# Gandi API token file (written by ansible, chmod 0600)
|
|
# Caddy reads this file for ACME DNS-01 challenges
|
|
caddy_gandi_token_file: /Users/erichblume/.config/caddy/gandi-token
|
|
|
|
# Domain configuration
|
|
caddy_domain: ops.eblu.me
|
|
|
|
# HTTPS port (443 is standard)
|
|
caddy_https_port: 443
|
|
|
|
# Services to proxy
|
|
# Format: { name: "service", host: "hostname", backend: "url" }
|
|
caddy_services:
|
|
# Indri-local services
|
|
- name: forge
|
|
host: "forge.{{ caddy_domain }}"
|
|
backend: "http://localhost:3001"
|
|
- name: registry
|
|
host: "registry.{{ caddy_domain }}"
|
|
backend: "http://localhost:5050"
|
|
|
|
# K8s services (via Tailscale Ingress)
|
|
# Caddy proxies to existing Tailscale endpoints - traffic stays local
|
|
- name: grafana
|
|
host: "grafana.{{ caddy_domain }}"
|
|
backend: "https://grafana.tail8d86e.ts.net"
|
|
- name: argocd
|
|
host: "argocd.{{ caddy_domain }}"
|
|
backend: "https://argocd.tail8d86e.ts.net"
|
|
- name: prometheus
|
|
host: "prometheus.{{ caddy_domain }}"
|
|
backend: "https://prometheus.tail8d86e.ts.net"
|
|
- name: loki
|
|
host: "loki.{{ caddy_domain }}"
|
|
backend: "https://loki.tail8d86e.ts.net"
|
|
- name: miniflux
|
|
host: "feed.{{ caddy_domain }}"
|
|
backend: "https://feed.tail8d86e.ts.net"
|
|
- name: devpi
|
|
host: "pypi.{{ caddy_domain }}"
|
|
backend: "https://pypi.tail8d86e.ts.net"
|
|
- name: kiwix
|
|
host: "kiwix.{{ caddy_domain }}"
|
|
backend: "https://kiwix.tail8d86e.ts.net"
|
|
- name: torrent
|
|
host: "torrent.{{ caddy_domain }}"
|
|
backend: "https://torrent.tail8d86e.ts.net"
|
|
- name: teslamate
|
|
host: "tesla.{{ caddy_domain }}"
|
|
backend: "https://tesla.tail8d86e.ts.net"
|
|
|
|
# Layer 4 (TCP) services
|
|
# Format: { port: external_port, backend: "host:port" }
|
|
caddy_tcp_services:
|
|
- port: 2222
|
|
backend: "localhost:2200" # Forgejo SSH
|
|
- port: 5432
|
|
backend: "pg.tail8d86e.ts.net:5432" # PostgreSQL
|