{
  email simon@renoux.dev

	metrics {
		per_host
	}
}

(logging) {
    log {
        output file /var/log/caddy/{args[0]}.log
        format console
        # level error
    }
}

rack.renoux.dev {
  respond "yup, this is a rack!"
}

celestenet.fantomitechno.dev {
  import logging cnet

  @not_local_net not client_ip 172.16.0.0/12

  abort @not_local_net
  reverse_proxy 127.0.0.1:1099
}

# Communication
matrix.fantomitechno.dev {
  import logging matrix
  reverse_proxy 127.0.0.1:2000
}

livekit.fantomitechno.dev {
  import logging livekit
  # for lk-jwt-service
  @lk-jwt-service path /sfu/get* /healthz* /get_token*
  route @lk-jwt-service {
    reverse_proxy 127.0.0.1:2001
  }

  # for livekit
  reverse_proxy 127.0.0.1:2002
}

pds.fantomitechno.dev {
  import logging pds
  reverse_proxy 127.0.0.1:2010
}

# Storage
knot.fantomitechno.dev {
  import logging knot
  reverse_proxy 127.0.0.1:4000
}

spindle.fantomitechno.dev {
  import logging spindle
  reverse_proxy 127.0.0.1:4001
}

git.fantomitechno.dev {
  import logging gitea

  @local_net client_ip 172.16.0.0/12
  @not_local_net not client_ip 172.16.0.0/12
  reverse_proxy @not_local_net 127.0.0.1:4006 {
    header_up X-Real-Ip {remote_host}
  }

  reverse_proxy @local_net 127.0.0.1:4005 {
    header_up X-Real-Ip {remote_host}
  }
}

hold.fantomitechno.dev {
  import logging hold
  reverse_proxy 127.0.0.1:4010
}

drive.renoux.dev, drive.s.renoux.dev {
  import logging cryptpad

  handle /cryptpad_websocket* {
    reverse_proxy 127.0.0.1:4021
  }

  handle {
    reverse_proxy 127.0.0.1:44020
  }
}

files.fantomitechno.dev {
  import logging copyparty
  reverse_proxy 127.0.0.1:4020
}

kiwix.fantomitechno.dev, kiwix.renoux.dev {
  import logging kiwix
  reverse_proxy 127.0.0.1:4030
}

wikipedia.renoux.dev {
  redir https://kiwix.renoux.dev/viewer#wikipedia_en_all_maxi_2026-02{uri}
}

photo.renoux.dev {
  import logging immich
  reverse_proxy 127.0.0.1:4040
}

vault.renoux.dev {
  import logging vaultwarden
  reverse_proxy 127.0.0.1:4050
}

pdf.fantom.home {
  import logging paperless

  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4060
  tls internal
}

notes.fantomitechno.dev {
  import logging affine
  reverse_proxy 127.0.0.1:4070
}

graph.fantom.home {
  import logging grafana
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:3000
  tls internal
}

fedi.fantomitechno.dev {
	root * /var/mastodon/public

	# gzip + zstd compression (replaces the gzip_* block)
	encode zstd gzip

	# HSTS on every response (nginx repeated this per location)
	header Strict-Transport-Security "max-age=63072000; includeSubDomains"

	# client_max_body_size 80m
	request_body {
		max_size 80MB
	}

	# --- Cache-Control headers ---
	@cache_week path /sw.js
	header @cache_week Cache-Control "public, max-age=604800, must-revalidate"

	@cache_month path /assets/* /avatars/* /emoji/* /headers/* /packs/* /shortcuts/* /sounds/*
	header @cache_month Cache-Control "public, max-age=2419200, must-revalidate"

	@cache_system path /system/*
	header @cache_system Cache-Control "public, max-age=2419200, immutable"

	# --- Streaming API (WebSockets are handled automatically) ---
	handle /api/v1/streaming* {
		reverse_proxy 127.0.0.1:2021 {
			flush_interval -1          # proxy_buffering off
			header_up X-Real-IP {remote_host}
			header_up -Proxy
		}
	}

	# --- Everything else: try static file, fall back to Rails ---
	handle {
		file_server {
			pass_thru                  # try_files $uri @proxy
		}
		reverse_proxy 127.0.0.1:2020 {
			header_up X-Real-IP {remote_host}
			header_up -Proxy
		}
	}

	# error_page 404 500 501 502 503 504 /500.html
	handle_errors {
		rewrite * /500.html
		file_server
	}
}

jellyfin.fantom.home {
  import logging jellyfin
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4080
  tls internal
}

music.fantom.home {
  import logging jellyfin
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4085
  tls internal
}

torrent.fantom.home {
  import logging qbittorrent
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4090
  tls internal
}

flaresolver.fantom.home {
  import logging flaresolver
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4091
  tls internal
}

prowlarr.fantom.home {
  import logging prowlarr
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4092
  tls internal
}

jackett.fantom.home {
  import logging jackett
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4093
  tls internal
}

sonarr.fantom.home {
  import logging sonarr
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4094
  tls internal
}

radarr.fantom.home {
  import logging radarr
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4095
  tls internal
}

bazarr.fantom.home {
  import logging bazarr
  
  @not_local_net not client_ip 172.16.0.0/12
  abort @not_local_net

  reverse_proxy 127.0.0.1:4096
  tls internal
}