Split hosts: media (gateway at /), files, clips, sync; live gains /dock, /dock/clock, /dump, /me, /time
configure.py: three new host roles (files/sync/clips) in --full, --hosts, .env, Caddy generator; main host serves about/ at the root (/about* redirects); /time only where it is fetched same-origin. about/index.html links across hosts; addCommunityMediaServer.sh asks for the new names; Caddyfile.example regenerated; README/FRESH-INSTALL/HOSTNAME-CHANGE (procedure C)/STATUS updated. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
@@ -1,29 +1,204 @@
|
||||
# vanguard:main
|
||||
media.example.com {
|
||||
encode zstd gzip
|
||||
|
||||
# dump endpoint (python service on the host, does its own auth)
|
||||
handle /dump* {
|
||||
reverse_proxy 127.0.0.1:8080
|
||||
# /logout on every gated host = sign out of the Discord login (domain-wide session)
|
||||
redir /logout /outpost.goauthentik.io/sign_out 302
|
||||
# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
|
||||
# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
|
||||
# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
|
||||
reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
|
||||
forward_auth 127.0.0.1:9000 {
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
||||
trusted_proxies private_ranges
|
||||
}
|
||||
|
||||
# Syncthing admin UI (its own login; strip the prefix, present a local Host to pass its host check)
|
||||
redir /sync /sync/ 308
|
||||
handle_path /sync/* {
|
||||
reverse_proxy 127.0.0.1:8384 {
|
||||
header_up Host {upstream_hostport}
|
||||
}
|
||||
# who does Authentik say I am? (debug: shows exactly the identity headers the apps receive)
|
||||
handle /whoami {
|
||||
header Content-Type text/plain
|
||||
respond "user: {http.request.header.X-Authentik-Username}
|
||||
groups: {http.request.header.X-Authentik-Groups}
|
||||
email: {http.request.header.X-Authentik-Email}
|
||||
name: {http.request.header.X-Authentik-Name}"
|
||||
}
|
||||
|
||||
# OBS browser dock (static)
|
||||
handle_path /dock* {
|
||||
root * /srv/dock
|
||||
file_server
|
||||
@me path /me /me/*
|
||||
handle @me {
|
||||
reverse_proxy 127.0.0.1:8080 # dumpd: identity for the gateway page
|
||||
}
|
||||
|
||||
# everything else is copyparty (web UI + WebDAV)
|
||||
redir /about* / 308 # old bookmarks: the gateway page used to live at /about/
|
||||
handle {
|
||||
reverse_proxy 127.0.0.1:3923 {
|
||||
flush_interval -1
|
||||
}
|
||||
root * /srv/about
|
||||
try_files {path} /index.html
|
||||
file_server # the gateway page is the root of the main host
|
||||
}
|
||||
}
|
||||
|
||||
# vanguard:apex
|
||||
example.com {
|
||||
redir https://media.example.com/ 302
|
||||
}
|
||||
|
||||
# vanguard:files
|
||||
files.example.com {
|
||||
encode zstd gzip
|
||||
# /logout on every gated host = sign out of the Discord login (domain-wide session)
|
||||
redir /logout /outpost.goauthentik.io/sign_out 302
|
||||
# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
|
||||
# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
|
||||
# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
|
||||
reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
|
||||
forward_auth 127.0.0.1:9000 {
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
||||
trusted_proxies private_ranges
|
||||
}
|
||||
# copyparty at the root. It honours X-Authentik-Username / -Groups only when the request also carries a header
|
||||
# whose secret NAME only this proxy knows (copyparty idp-h-key). Clients cannot forge identity.
|
||||
reverse_proxy 127.0.0.1:3923 {
|
||||
header_up X-Vanguard-EXAMPLEKEY 1
|
||||
flush_interval -1
|
||||
}
|
||||
}
|
||||
|
||||
# vanguard:sync
|
||||
sync.example.com {
|
||||
encode zstd gzip
|
||||
# /logout on every gated host = sign out of the Discord login (domain-wide session)
|
||||
redir /logout /outpost.goauthentik.io/sign_out 302
|
||||
# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
|
||||
# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
|
||||
# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
|
||||
reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
|
||||
forward_auth 127.0.0.1:9000 {
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
||||
trusted_proxies private_ranges
|
||||
}
|
||||
@lacks_group not header_regexp X-Authentik-Groups (^|\|)media\-admins(\||$)
|
||||
handle @lacks_group {
|
||||
respond "This page is for members of the 'media-admins' group." 403
|
||||
}
|
||||
# Syncthing admin UI (its own GUI login is disabled; the gate + group is the login)
|
||||
reverse_proxy 127.0.0.1:8384 {
|
||||
header_up Host {upstream_hostport}
|
||||
}
|
||||
}
|
||||
|
||||
# vanguard:clips
|
||||
clips.example.com {
|
||||
encode zstd gzip
|
||||
# /logout on every gated host = sign out of the Discord login (domain-wide session)
|
||||
redir /logout /outpost.goauthentik.io/sign_out 302
|
||||
# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
|
||||
# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
|
||||
# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
|
||||
reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
|
||||
forward_auth 127.0.0.1:9000 {
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
||||
trusted_proxies private_ranges
|
||||
}
|
||||
@me path /me /me/*
|
||||
handle @me {
|
||||
reverse_proxy 127.0.0.1:8080 # dumpd: identity + /me/clips self-service
|
||||
}
|
||||
handle {
|
||||
root * /srv/clips
|
||||
try_files {path} /index.html
|
||||
file_server
|
||||
}
|
||||
}
|
||||
|
||||
# vanguard:live
|
||||
live.example.com {
|
||||
encode zstd gzip
|
||||
# /logout on every gated host = sign out of the Discord login (domain-wide session)
|
||||
redir /logout /outpost.goauthentik.io/sign_out 302
|
||||
# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
|
||||
# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
|
||||
# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
|
||||
reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
|
||||
forward_auth 127.0.0.1:9000 {
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
||||
trusted_proxies private_ranges
|
||||
}
|
||||
handle /whoami {
|
||||
header Content-Type text/plain
|
||||
respond "user: {http.request.header.X-Authentik-Username}
|
||||
groups: {http.request.header.X-Authentik-Groups}"
|
||||
}
|
||||
@me path /me /me/*
|
||||
handle @me {
|
||||
reverse_proxy 127.0.0.1:8080 # dumpd: identity, stream tokens (Go Live + dock)
|
||||
}
|
||||
handle /time {
|
||||
reverse_proxy 127.0.0.1:8080 # server clock for the timecode strip (clock page + Go Live)
|
||||
}
|
||||
handle /dump* {
|
||||
reverse_proxy 127.0.0.1:8080 # dump tonight (dock)
|
||||
}
|
||||
handle_path /dock* {
|
||||
root * /srv/dock
|
||||
file_server # OBS browser dock + /dock/clock/
|
||||
}
|
||||
handle_path /api/* {
|
||||
reverse_proxy 127.0.0.1:9997
|
||||
}
|
||||
handle_path /webrtc/* {
|
||||
# Go Live sends MediaMTX credentials in X-Stream-Auth so Authentik's forward-auth never sees an
|
||||
# Authorization header; Caddy turns it into Authorization only on the hop to MediaMTX.
|
||||
@creds header X-Stream-Auth *
|
||||
reverse_proxy @creds 127.0.0.1:8889 {
|
||||
header_up Authorization {http.request.header.X-Stream-Auth}
|
||||
header_up -X-Stream-Auth
|
||||
}
|
||||
reverse_proxy 127.0.0.1:8889
|
||||
}
|
||||
handle_path /hls/* {
|
||||
reverse_proxy 127.0.0.1:8888
|
||||
}
|
||||
handle {
|
||||
root * /srv/live
|
||||
try_files {path} /index.html
|
||||
file_server
|
||||
}
|
||||
}
|
||||
|
||||
# vanguard:bot
|
||||
bot.example.com {
|
||||
encode zstd gzip
|
||||
# /logout on every gated host = sign out of the Discord login (domain-wide session)
|
||||
redir /logout /outpost.goauthentik.io/sign_out 302
|
||||
# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
|
||||
# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
|
||||
# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
|
||||
reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
|
||||
forward_auth 127.0.0.1:9000 {
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
||||
trusted_proxies private_ranges
|
||||
}
|
||||
@lacks_group not header_regexp X-Authentik-Groups (^|\|)bot\-users(\||$)
|
||||
handle @lacks_group {
|
||||
respond "This page is for members of the 'bot-users' group." 403
|
||||
}
|
||||
reverse_proxy 127.0.0.1:8000
|
||||
}
|
||||
|
||||
# vanguard:git
|
||||
git.example.com {
|
||||
encode zstd gzip
|
||||
reverse_proxy 127.0.0.1:3000
|
||||
}
|
||||
|
||||
# vanguard:auth
|
||||
auth.example.com {
|
||||
encode zstd gzip
|
||||
reverse_proxy 127.0.0.1:9000
|
||||
}
|
||||
|
||||
# vanguard:watch
|
||||
watch.example.com {
|
||||
encode zstd gzip
|
||||
reverse_proxy 127.0.0.1:8096
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user