From a2e4594a72f0997145e1fc842ce4307a8ea5be4b Mon Sep 17 00:00:00 2001
From: Guido X Jansen <x@gui.do>
Date: Sun, 14 Jun 2026 21:03:11 +0200
Subject: [PATCH] feat(caddy): import custom *.caddy vhosts from ./caddy.d
 (#113)

Mount ./caddy.d read-only at /etc/caddy/conf.d and import *.caddy from it,
so operators can serve extra sites on the same box (status page, another app,
a comments backend) without forking this template. Directory contents are
gitignored; an empty directory is a no-op.
---
 .gitignore         |  4 ++++
 Caddyfile          | 10 ++++++++++
 README.md          | 18 ++++++++++++++++++
 caddy.d/.gitkeep   |  0
 docker-compose.yml |  1 +
 5 files changed, 33 insertions(+)
 create mode 100644 caddy.d/.gitkeep

diff --git a/.gitignore b/.gitignore
index c974669..fa60a4f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,7 @@ Thumbs.db
 *.swp
 *.swo
 .worktrees/
+
+# Custom Caddy vhosts (machine-local, may contain private domains)
+caddy.d/*
+!caddy.d/.gitkeep
diff --git a/Caddyfile b/Caddyfile
index 7660119..c81ec41 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -71,3 +71,13 @@ docs.barazo.forum {
 	header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
 	reverse_proxy grafana:3050
 }
+
+# ---------------------------------------------------------------------------
+# Custom site blocks (optional)
+# ---------------------------------------------------------------------------
+# Drop additional *.caddy files into ./caddy.d/ to serve extra vhosts (e.g. a
+# status page, a comments backend, another app on the same box) without forking
+# this template. The directory is mounted read-only at /etc/caddy/conf.d and is
+# gitignored, so your custom config survives `git pull` and never ships here.
+# An empty directory is a no-op.
+import /etc/caddy/conf.d/*.caddy
diff --git a/README.md b/README.md
index 9907d77..7a78991 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,24 @@ Everything you need to self-host a [Barazo](https://github.com/singi-labs) forum
 
 Production uses two-network segmentation: PostgreSQL and Valkey sit on the `backend` network only and are unreachable from Caddy or the frontend. Only ports 80 and 443 are exposed externally.
 
+### Custom Caddy vhosts
+
+Caddy imports any `*.caddy` file you drop into `./caddy.d/`, so you can serve extra
+sites on the same box (a status page, another app, a comments backend) without
+forking this template. The directory is mounted read-only at `/etc/caddy/conf.d`
+and its contents are gitignored, so your config survives `git pull` and is never
+committed here. Example `caddy.d/status.example.com.caddy`:
+
+```caddy
+status.example.com {
+	reverse_proxy my-status-app:8080
+}
+```
+
+Reverse-proxy targets must share Caddy's `frontend` network (attach your container
+to it as an external network). An empty `caddy.d/` directory is a no-op. After
+adding or changing a file, recreate Caddy: `docker compose up -d caddy`.
+
 ---
 
 ## Image Tags
diff --git a/caddy.d/.gitkeep b/caddy.d/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/docker-compose.yml b/docker-compose.yml
index 577bbc1..13171bd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -185,6 +185,7 @@ services:
       - "443:443/udp"   # HTTP/3 (QUIC)
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./caddy.d:/etc/caddy/conf.d:ro      # optional custom *.caddy vhosts (gitignored)
       - caddydata:/data
       - caddyconfig:/config
       - /var/www/docs.barazo.forum:/var/www/docs.barazo.forum:ro
-- 
2.51.2