{
	servers {
		metrics                           # Prometheus metrics at http://127.0.0.1:2019/metrics (LOGGING.md)
	}
}

# vanguard:main
media.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	# /logout on every gated host = sign out of the Discord login (domain-wide session)
	redir /logout /outpost.goauthentik.io/sign_out 302
	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
	# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
	# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
	reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
	forward_auth 127.0.0.1:9000 {
		uri /outpost.goauthentik.io/auth/caddy
		copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
		trusted_proxies private_ranges
	}
	# who does Authentik say I am? (debug: shows exactly the identity headers the apps receive)
	handle /whoami {
		header Content-Type text/plain
		respond "user:   {http.request.header.X-Authentik-Username}
groups: {http.request.header.X-Authentik-Groups}
email:  {http.request.header.X-Authentik-Email}
name:   {http.request.header.X-Authentik-Name}"
	}
	@me path /me /me/*
	handle @me {
		reverse_proxy 127.0.0.1:8080          # dumpd: identity for the gateway page
	}
	redir /about* / 308                       # old bookmarks: the gateway page used to live at /about/
	handle {
		root * /srv/about
		try_files {path} /index.html
		file_server                           # the gateway page is the root of the main host
	}
}

# vanguard:files
files.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	# /logout on every gated host = sign out of the Discord login (domain-wide session)
	redir /logout /outpost.goauthentik.io/sign_out 302
	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
	# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
	# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
	reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
	forward_auth 127.0.0.1:9000 {
		uri /outpost.goauthentik.io/auth/caddy
		copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
		trusted_proxies private_ranges
	}
	# copyparty at the root. It honours X-Authentik-Username / -Groups only when the request also carries a header
	# whose secret NAME only this proxy knows (copyparty idp-h-key). Clients cannot forge identity.
	reverse_proxy 127.0.0.1:3923 {
		header_up X-Vanguard-k 1
		flush_interval -1
	}
}

# vanguard:sync
sync.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	# /logout on every gated host = sign out of the Discord login (domain-wide session)
	redir /logout /outpost.goauthentik.io/sign_out 302
	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
	# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
	# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
	reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
	forward_auth 127.0.0.1:9000 {
		uri /outpost.goauthentik.io/auth/caddy
		copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
		trusted_proxies private_ranges
	}
	@lacks_group not header_regexp X-Authentik-Groups (^|\|)media\-admins(\||$)
	handle @lacks_group {
		respond "This page is for members of the 'media-admins' group." 403
	}
	# Syncthing admin UI (its own GUI login is disabled; the gate + group is the login)
	reverse_proxy 127.0.0.1:8384 {
		header_up Host {upstream_hostport}
	}
}

# vanguard:clips
clips.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	# /logout on every gated host = sign out of the Discord login (domain-wide session)
	redir /logout /outpost.goauthentik.io/sign_out 302
	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
	# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
	# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
	reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
	forward_auth 127.0.0.1:9000 {
		uri /outpost.goauthentik.io/auth/caddy
		copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
		trusted_proxies private_ranges
	}
	@me path /me /me/*
	handle @me {
		reverse_proxy 127.0.0.1:8080          # dumpd: identity + /me/clips self-service
	}
	handle {
		root * /srv/clips
		try_files {path} /index.html
		file_server
	}
}

# vanguard:diag
diag.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	# /logout on every gated host = sign out of the Discord login (domain-wide session)
	redir /logout /outpost.goauthentik.io/sign_out 302
	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
	# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
	# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
	reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
	forward_auth 127.0.0.1:9000 {
		uri /outpost.goauthentik.io/auth/caddy
		copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
		trusted_proxies private_ranges
	}
	@lacks_group not header_regexp X-Authentik-Groups (^|\|)media\-admins(\||$)
	handle @lacks_group {
		respond "This page is for members of the 'media-admins' group." 403
	}
	# VictoriaLogs runs with -http.pathPrefix=/logs and emits /logs/... URLs itself, so the prefix is
	# passed through unchanged. Stripping it would break the UI's own asset paths.
	redir /logs /logs/select/vmui/ 302
	redir /logs/ /logs/select/vmui/ 302
	handle /logs* {
		reverse_proxy 127.0.0.1:9428
	}
	handle /metrics-db* {
		reverse_proxy 127.0.0.1:8428          # VictoriaMetrics UI + query API
	}
	handle /alerts* {
		reverse_proxy 127.0.0.1:9093          # Alertmanager: what is firing, silences
	}
	handle /rules-metrics* {
		reverse_proxy 127.0.0.1:8880          # vmalert over VictoriaMetrics
	}
	handle /rules-logs* {
		reverse_proxy 127.0.0.1:8881          # vmalert over VictoriaLogs
	}
	handle {
		respond "Vanguard diagnostics

/logs            logs (VictoriaLogs)
/metrics-db      metrics (VictoriaMetrics)
/alerts          what is firing (Alertmanager)
/rules-metrics   metric rules (vmalert)
/rules-logs      log rules (vmalert)

Alerts go to Discord. The deadman runs on the host and watches this stack." 200
	}
}

# vanguard:live
live.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	# /logout on every gated host = sign out of the Discord login (domain-wide session)
	redir /logout /outpost.goauthentik.io/sign_out 302
	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
	# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
	# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
	reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
	forward_auth 127.0.0.1:9000 {
		uri /outpost.goauthentik.io/auth/caddy
		copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
		trusted_proxies private_ranges
	}
	handle /whoami {
		header Content-Type text/plain
		respond "user:   {http.request.header.X-Authentik-Username}
groups: {http.request.header.X-Authentik-Groups}"
	}
	@me path /me /me/*
	handle @me {
		reverse_proxy 127.0.0.1:8080          # dumpd: identity, stream tokens (Go Live + dock)
	}
	handle /time {
		reverse_proxy 127.0.0.1:8080          # server clock for the timecode strip (clock page + Go Live)
	}
	handle /dump* {
		reverse_proxy 127.0.0.1:8080          # dump tonight (dock)
	}
	handle_path /dock* {
		root * /srv/dock
		file_server                           # OBS browser dock + /dock/clock/
	}
	handle_path /api/* {
		reverse_proxy 127.0.0.1:9997
	}
	handle_path /webrtc/* {
		# Go Live sends MediaMTX credentials in X-Stream-Auth so Authentik's forward-auth never sees an
		# Authorization header; Caddy turns it into Authorization only on the hop to MediaMTX.
		@creds header X-Stream-Auth *
		reverse_proxy @creds 127.0.0.1:8889 {
			header_up Authorization {http.request.header.X-Stream-Auth}
			header_up -X-Stream-Auth
		}
		reverse_proxy 127.0.0.1:8889
	}
	handle_path /hls/* {
		reverse_proxy 127.0.0.1:8888
	}
	handle {
		root * /srv/live
		try_files {path} /index.html
		file_server
	}
}

# vanguard:bot
bot.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	# /logout on every gated host = sign out of the Discord login (domain-wide session)
	redir /logout /outpost.goauthentik.io/sign_out 302
	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
	# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
	# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
	reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000
	forward_auth 127.0.0.1:9000 {
		uri /outpost.goauthentik.io/auth/caddy
		copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
		trusted_proxies private_ranges
	}
	@lacks_group not header_regexp X-Authentik-Groups (^|\|)bot\-users(\||$)
	handle @lacks_group {
		respond "This page is for members of the 'bot-users' group." 403
	}
	reverse_proxy 127.0.0.1:8000
}

# vanguard:git
git.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	reverse_proxy 127.0.0.1:3000
}

# vanguard:auth
auth.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	reverse_proxy 127.0.0.1:9000
}

# vanguard:watch
watch.example.com {
	encode zstd gzip
	log {
		output stderr
		format filter {
			wrap json
			fields {
				request>headers>Cookie delete
				request>headers>Authorization delete
				request>headers>X-Stream-Auth delete
			}
		}
	}
	reverse_proxy 127.0.0.1:8096
}