jgitta
821f954200
- Create INFRASTRUCTURE-COMPLETE.md: Comprehensive infrastructure overview * Network architecture and DNS configuration * Storage architecture for Nextcloud (1.4TB warm storage via LVM) * Kopia backup setup with Backblaze B2 integration * Caddy reverse proxy configuration (CT 202) * Security configuration and capacity planning - Add Caddy reverse proxy configurations: * caddy-kopia-integration.md: Integration steps for CT 202 * caddy-kopia-reverse-proxy.md: Complete configuration reference * caddy/Caddyfile: Production-ready configuration * caddy/docker-compose.yml: Docker deployment spec - Add Kopia backup documentation: * kopia-nextcloud-backblaze-setup.md: Complete Kopia setup guide * Backup strategy, retention policies, and restore procedures - Update related documentation with consolidated references Status: Infrastructure documented and ready for deployment
66 lines
2.2 KiB
Caddyfile
66 lines
2.2 KiB
Caddyfile
# Caddy Configuration for Homelab
|
|
# Location: /srv/docker/caddy/Caddyfile
|
|
# Last Updated: April 27, 2026
|
|
|
|
# ============================================================================
|
|
# Kopia Web UI - HTTPS Reverse Proxy
|
|
# ============================================================================
|
|
kopia.jgitta.com {
|
|
# Reverse proxy to Kopia Web UI running on localhost:51515
|
|
reverse_proxy 127.0.0.1:51515 {
|
|
# Pass original headers for proper proxying
|
|
header_upstream X-Forwarded-Proto {scheme}
|
|
header_upstream X-Forwarded-Host {http.request.host}
|
|
header_upstream X-Forwarded-For {http.request.remote.host}
|
|
|
|
# WebSocket support (Kopia uses WebSockets for real-time updates)
|
|
header_upstream Connection {http.request.header.Connection}
|
|
header_upstream Upgrade {http.request.header.Upgrade}
|
|
|
|
# Timeout settings for backup operations (which can be slow)
|
|
timeout 300s
|
|
}
|
|
|
|
# Security headers
|
|
header {
|
|
# Prevent MIME type sniffing
|
|
X-Content-Type-Options "nosniff"
|
|
|
|
# Clickjacking protection
|
|
X-Frame-Options "SAMEORIGIN"
|
|
|
|
# XSS protection
|
|
X-XSS-Protection "1; mode=block"
|
|
|
|
# HTTPS enforcement (HSTS)
|
|
# max-age: 1 year, includeSubDomains: apply to subdomains
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
|
|
# Content Security Policy (basic)
|
|
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
|
|
|
|
# Referrer policy
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
|
|
# Permissions policy
|
|
Permissions-Policy "geolocation=(), microphone=(), camera=()"
|
|
}
|
|
|
|
# Logging
|
|
log {
|
|
output stdout
|
|
format json
|
|
}
|
|
|
|
# Enable TLS (automatic, self-signed for internal use)
|
|
tls internal
|
|
}
|
|
|
|
# ============================================================================
|
|
# HTTP to HTTPS Redirect
|
|
# ============================================================================
|
|
http://kopia.jgitta.com {
|
|
# Redirect all HTTP traffic to HTTPS
|
|
redir https://kopia.jgitta.com{uri} permanent
|
|
}
|