# ~$ selfhostedops — Caddyfile
# Automatic HTTPS for every subdomain. Nothing to renew, ever.

{
	email {$ACME_EMAIL}
}

git.{$DOMAIN} {
	reverse_proxy forgejo:3000
}

wiki.{$DOMAIN} {
	reverse_proxy outline:3000
}

vault.{$DOMAIN} {
	reverse_proxy vaultwarden:80
}

status.{$DOMAIN} {
	reverse_proxy uptime-kuma:3001
}

# n8n has no public route any more - it is reachable over the mesh only (episode 5)

# NetBird control plane (episode 5) - dashboard, API, gRPC, relay, built-in IdP
vpn.{$DOMAIN} {
	# Native gRPC (needs HTTP/2 cleartext to backend)
	@grpc header Content-Type application/grpc*
	reverse_proxy @grpc h2c://netbird-server:80

	# Combined server paths (relay, signal, management, OAuth2)
	@backend path /relay* /ws-proxy/* /api/* /oauth2/*
	reverse_proxy @backend netbird-server:80

	# Dashboard (everything else)
	reverse_proxy /* netbird-dashboard:80
}