Caddyfile

{
    # Global options - works for both environments
    email {$LETSENCRYPT_EMAIL}
}

# Main Website (Base Domain)
{$BASE_DOMAIN} {
    root * /srv/website
    file_server
    encode gzip
    
    # Optional: Fallback für SPA oder custom 404
    try_files {path} /index.html
}

# N8N
{$N8N_HOSTNAME} {
    # For domains, Caddy will automatically use Let's Encrypt
    # For localhost/port addresses, HTTPS won't be enabled
    reverse_proxy n8n:5678
}

# Open WebUI
{$WEBUI_HOSTNAME} {
    reverse_proxy open-webui:8080
}

# Flowise
{$FLOWISE_HOSTNAME} {
    reverse_proxy flowise:3001
}

# bolt.diy
{$BOLT_HOSTNAME} {
    basic_auth {
        {$BOLT_USERNAME} {$BOLT_PASSWORD_HASH}
    }
    reverse_proxy bolt:5173
}

# OpenUI - AI UI Generator
{$OPENUI_HOSTNAME} {
    reverse_proxy openui:7878
}

# Dify
{$DIFY_HOSTNAME} {
    reverse_proxy nginx:80
}

# RAGApp
{$RAGAPP_HOSTNAME} {
    basic_auth {
        {$RAGAPP_USERNAME} {$RAGAPP_PASSWORD_HASH}
    }
    reverse_proxy ragapp:8000
}

# Langfuse
{$LANGFUSE_HOSTNAME} {
    reverse_proxy langfuse-web:3000
}

# # Ollama API
# {$OLLAMA_HOSTNAME} {
#     reverse_proxy ollama:11434
# }

# Supabase
{$SUPABASE_HOSTNAME} {
    reverse_proxy kong:8000
}

# Grafana
{$GRAFANA_HOSTNAME} {
    reverse_proxy grafana:3000
}

# Prometheus
{$PROMETHEUS_HOSTNAME} {
    basic_auth { 
        {$PROMETHEUS_USERNAME} {$PROMETHEUS_PASSWORD_HASH}
    }
    reverse_proxy prometheus:9090
}

# Portainer
{$PORTAINER_HOSTNAME} {
    reverse_proxy portainer:9000
}

# Postiz
{$POSTIZ_HOSTNAME} {
    reverse_proxy postiz:5000
}

# Letta
{$LETTA_HOSTNAME} {
    reverse_proxy letta:8283
}

# Weaviate
{$WEAVIATE_HOSTNAME} {
    reverse_proxy weaviate:8080
}

# Qdrant
{$QDRANT_HOSTNAME} {
    reverse_proxy qdrant:6333
}

# ComfyUI
{$COMFYUI_HOSTNAME} {
    basic_auth {
        {$COMFYUI_USERNAME} {$COMFYUI_PASSWORD_HASH}
    }
    reverse_proxy comfyui:8188
}

# Whisper (Speech-to-Text) - Protected with Basic Auth
{$WHISPER_HOSTNAME} {
    basic_auth {
        {$WHISPER_AUTH_USER} {$WHISPER_AUTH_PASSWORD_HASH}
    }
    reverse_proxy faster-whisper:8000
}

# OpenedAI-Speech (Text-to-Speech) - Protected with Basic Auth
{$TTS_HOSTNAME} {
    basic_auth {
        {$TTS_AUTH_USER} {$TTS_AUTH_PASSWORD_HASH}
    }
    reverse_proxy openedai-speech:8000
}

# Scriberr - AI Audio Transcription with Speaker Diarization
{$SCRIBERR_HOSTNAME} {
    reverse_proxy scriberr:8080 {
        # For larger Audio-Uploads
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        # Larger Timeouts for big transcription process
        transport http {
            read_timeout 600s
            write_timeout 600s
        }
    }
}

# LibreTranslate (Self-hosted Translation API)
{$LIBRETRANSLATE_HOSTNAME} {
    basic_auth {
        {$LIBRETRANSLATE_USERNAME} {$LIBRETRANSLATE_PASSWORD_HASH}
    }
    reverse_proxy libretranslate:5000
}

# LightRAG (Graph-based RAG)
{$LIGHTRAG_HOSTNAME} {
    reverse_proxy lightrag:9621
}

# Perplexica (AI-powered search) - Protected with Basic Auth
{$PERPLEXICA_HOSTNAME} {
    basic_auth {
        {$PERPLEXICA_USERNAME} {$PERPLEXICA_PASSWORD_HASH}
    }
    reverse_proxy perplexica:3000
}

# Odoo ERP/CRM
{$ODOO_HOSTNAME} {
    @dbmanager {
        path /web/database/*
    }
    basic_auth @dbmanager {
        {$ODOO_USERNAME} {$ODOO_PASSWORD_HASH}
    }
    reverse_proxy odoo:8069 {
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Real-IP {remote_host}  # Nur IP, ohne Port!
        header_up X-Forwarded-For {remote_host}  # Nur IP, ohne Port!
    }
}

# =============================================================================
# CRM SYSTEMS
# =============================================================================

# Twenty CRM - Modern Customer Relationship Management
{$TWENTY_CRM_HOSTNAME} {
    reverse_proxy twenty-crm:3000 {
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
    }
}

# EspoCRM - Full-Featured Customer Relationship Management
{$ESPOCRM_HOSTNAME} {
    reverse_proxy espocrm:80 {
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
    }
}

# ============================================
# MAUTIC - Marketing Automation Platform
# ============================================
{$MAUTIC_HOSTNAME} {
    # Security Headers
    header {
        X-Frame-Options "SAMEORIGIN"
        X-Content-Type-Options "nosniff"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
    }

    # Proxy to Mautic
    reverse_proxy mautic_web:80 {
        # Important for Mautic tracking
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
        
        # Increase timeouts for large imports
        transport http {
            read_timeout 300s
            write_timeout 300s
        }
    }

    # Cache static assets
    @static {
        path *.css *.js *.jpg *.jpeg *.png *.gif *.ico *.svg *.woff *.woff2
    }
    header @static Cache-Control "public, max-age=604800"

    # File upload size
    request_body {
        max_size 50MB
    }
}

# Baserow (Airtable Alternative)
{$BASEROW_HOSTNAME} {
    reverse_proxy baserow:80
}

# NocoDB - Open Source Airtable Alternative
{$NOCODB_HOSTNAME} {
    reverse_proxy nocodb:8080 {
        # WebSocket support for realtime collaboration
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        # Explicit WebSocket headers
        header_up Connection {http.request.header.Connection}
        header_up Upgrade {http.request.header.Upgrade}
    }
}

# Vikunja - Task Management
{$VIKUNJA_HOSTNAME} {
    reverse_proxy vikunja:3456
}

# Leantime - Project Management Suite
{$LEANTIME_HOSTNAME} {
    reverse_proxy leantime:8080
}

# Cal.com - Open Source Scheduling Platform
{$CALCOM_HOSTNAME} {
    reverse_proxy calcom:3000 {
        # Important for WebSocket support
        header_up Host {host}
        header_up X-Real-IP {remote}
        header_up X-Forwarded-For {remote}
        header_up X-Forwarded-Proto {scheme}
    }
}

# ============================================================================
# MAIL SERVICES
# ============================================================================

# Mailpit Web Interface (Mail Catcher - always active) - WITH BASIC AUTH
{$MAILPIT_HOSTNAME} {
    basic_auth {
        {$MAILPIT_USERNAME} {$MAILPIT_PASSWORD_HASH}
    }
    reverse_proxy mailpit:8025
}

# SnappyMail Webmail Client
{$SNAPPYMAIL_HOSTNAME} {
    reverse_proxy snappymail:8888
}

# Neo4j
{$NEO4J_HOSTNAME} {
    reverse_proxy neo4j:7474
}

# Neo4j Bolt Protocol (wss)
https://{$NEO4J_HOSTNAME}:7687 {
    reverse_proxy neo4j:7687
}

# =============================================================================
# JITSI MEET - Professional Video Conferencing (NO Auth - for meeting guests!)
# =============================================================================
{$JITSI_HOSTNAME} {
    # WebSocket for XMPP first
    @websocket_xmpp {
        path /xmpp-websocket*
        header Connection *Upgrade*
        header Upgrade websocket
    }
    reverse_proxy @websocket_xmpp jitsi-prosody:5280
    
    # BOSH
    @bosh {
        path /http-bind*
    }
    reverse_proxy @bosh jitsi-prosody:5280
    
    # Colibri WebSocket
    @websocket_colibri {
        path /colibri-ws/*
        header Connection *Upgrade*
        header Upgrade websocket
    }
    reverse_proxy @websocket_colibri jitsi-jvb:9090
    
    reverse_proxy jitsi-web:80 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
    }
}

# =============================================================================
# LIVEKIT - Real-time Voice & Video Infrastructure (NO Basic Auth - uses JWT!)
# =============================================================================
{$LIVEKIT_HOSTNAME} {
    reverse_proxy livekit-server:7880 {
        transport http {
            versions 1.1
        }
    }
}

# =============================================================================
# VAULTWARDEN - Self-hosted Password Manager (NO Basic Auth - uses own auth!)
# =============================================================================
{$VAULTWARDEN_HOSTNAME} {
    reverse_proxy vaultwarden:80 {
        # Send real IP for rate limiting and logging
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
    }
    
    # Security headers for Vaultwarden
    header {
        # Enable HSTS
        Strict-Transport-Security max-age=31536000;
        # Prevent clickjacking
        X-Frame-Options DENY
        # Prevent content-type sniffing
        X-Content-Type-Options nosniff
        # XSS protection
        X-XSS-Protection "1; mode=block"
        # Referrer policy
        Referrer-Policy same-origin
    }
}

# =============================================================================
# KOPIA - Fast and Secure Backup Server (Uses own authentication)
# =============================================================================
{$KOPIA_HOSTNAME} {
    reverse_proxy kopia:51515 {
        # For WebSocket connections
        header_up Connection {>Connection}
        header_up Upgrade {>Upgrade}
        # Send real IP for logging
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
    }
    
    # Security headers for Kopia
    header {
        # Enable HSTS
        Strict-Transport-Security max-age=31536000;
        # Prevent clickjacking
        X-Frame-Options SAMEORIGIN
        # Prevent content-type sniffing
        X-Content-Type-Options nosniff
        # XSS protection
        X-XSS-Protection "1; mode=block"
    }
}

# Kimai - Professional Time Tracking
{$KIMAI_HOSTNAME} {
    reverse_proxy kimai:8001
}

# Invoice Ninja - Professional Invoicing Platform
{$INVOICENINJA_HOSTNAME} {
    reverse_proxy invoiceninja_nginx:80 {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
        header_up X-Real-IP {remote_host}
    }
}

# Formbricks - Open Source Survey Platform
{$FORMBRICKS_HOSTNAME} {
    reverse_proxy formbricks:3000 {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
        header_up X-Real-IP {remote_host}
        # WebSocket support for live updates
        header_up Connection {http.request.header.Connection}
        header_up Upgrade {http.request.header.Upgrade}
    }
}

# Metabase - Business Intelligence Platform
{$METABASE_HOSTNAME} {
    reverse_proxy metabase:3000
}

# Stirling-PDF - Advanced PDF Tools
{$STIRLING_HOSTNAME} {
    reverse_proxy stirling-pdf:8080 {
        # For large PDF uploads
        header_up X-Real-IP {remote_host}
    }
}

# ============================================
# TTS Chatterbox API - Advanced Text-to-Speech
# ============================================
{$CHATTERBOX_HOSTNAME} {
    reverse_proxy chatterbox-tts:4123 {
        flush_interval -1
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up Accept-Ranges bytes
    }
}

# ============================================
# TTS Chatterbox Frontend - Web UI
# ============================================
{$CHATTERBOX_FRONTEND_HOSTNAME} {
    # Frontend UI
    handle /* {
        reverse_proxy chatterbox-frontend:80
    }
    
    # API proxy for frontend
    handle /api/* {
        reverse_proxy chatterbox-tts:4123
    }
}

# SearXNG
{$SEARXNG_HOSTNAME} {
    @protected not remote_ip 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10

    basic_auth @protected {
        {$SEARXNG_USERNAME} {$SEARXNG_PASSWORD_HASH}
    }

    encode zstd gzip
    
    @api {
        path /config
        path /healthz
        path /stats/errors
        path /stats/checker
    }
    @search {
        path /search
    }
    @imageproxy {
        path /image_proxy
    }
    @static {
        path /static/*
    }
    
    header {
        # CSP (https://content-security-policy.com)
        Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src * data:; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com;"
        # Disable some browser features
        Permissions-Policy "accelerometer=(),camera=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),payment=(),usb=()"
        # Set referrer policy
        Referrer-Policy "no-referrer"
        # Force clients to use HTTPS
        Strict-Transport-Security "max-age=31536000"
        # Prevent MIME type sniffing from the declared Content-Type
        X-Content-Type-Options "nosniff"
        # X-Robots-Tag (comment to allow site indexing)
        X-Robots-Tag "noindex, noarchive, nofollow"
        # Remove "Server" header
        -Server
    }
    
    header @api {
        Access-Control-Allow-Methods "GET, OPTIONS"
        Access-Control-Allow-Origin "*"
    }
    
    route {
        # Cache policy
        header Cache-Control "max-age=0, no-store"
        header @search Cache-Control "max-age=5, private"
        header @imageproxy Cache-Control "max-age=604800, public"
        header @static Cache-Control "max-age=31536000, public, immutable"
    }
    
    # SearXNG (uWSGI)
    reverse_proxy searxng:8080 {
        header_up X-Forwarded-Port {http.request.port}
        header_up X-Real-IP {http.request.remote.host}
        # https://github.com/searx/searx-docker/issues/24
        header_up Connection "close"
    }
}

# n8n-MCP - Model Context Protocol Server
{$N8N_MCP_HOSTNAME} {
    reverse_proxy n8n-mcp:3000
}

# ============================================================================
# AI RESEARCH TOOLS
# ============================================================================

# GPT Researcher - Autonomous Research Agent (Smart Auth)
{$GPTR_HOSTNAME} {
    # WebSocket directly without Auth
    @websocket {
        path /ws
        header Connection *Upgrade*
        header Upgrade websocket
    }
    handle @websocket {
        reverse_proxy gpt-researcher:8000
    }
    
    # UI with Auth
    handle {
        basic_auth {
            {$GPTR_USERNAME} {$GPTR_PASSWORD_HASH}
        }
        
        # API to Backend
        handle /api/* {
            reverse_proxy gpt-researcher:8000
        }
        
        # Frontend
        reverse_proxy gpt-researcher-ui:3000
    }
}

# ============================================================================
# DOCUMENT MANAGEMENT & FILE SHARING
# ============================================================================

# Seafile - File Sync & Share Platform
{$SEAFILE_HOSTNAME} {
    reverse_proxy seafile:80
}

# Paperless-ngx - Document Management with OCR
{$PAPERLESS_HOSTNAME} {
    reverse_proxy paperless:8000 {
        flush_interval -1
    }
}

# Paperless-GPT - OCR Enhancement (WITH Basic Auth)
{$PAPERLESS_GPT_HOSTNAME} {
    basic_auth {
        {$PAPERLESS_GPT_USERNAME} {$PAPERLESS_GPT_PASSWORD_HASH}
    }
    reverse_proxy paperless-gpt:8080
}

# Paperless-AI - RAG Chat & Semantic Search (NO Basic Auth - has own login!)
{$PAPERLESS_AI_HOSTNAME} {
    reverse_proxy paperless-ai:3000
}

# ============================================================================
# OPEN NOTEBOOK - AI-Powered Knowledge Management & Research
# ============================================================================

# Open Notebook - Privacy-First Alternative zu Google NotebookLM
{$OPENNOTEBOOK_HOSTNAME} {
    # CORS Headers for API access
    @api {
        path /api/* /docs*
    }
    
    handle @api {
        # CORS Headers
        header Access-Control-Allow-Origin "*"
        header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
        header Access-Control-Allow-Headers "Content-Type, Authorization"
        
        # Handle OPTIONS preflight
        @options {
            method OPTIONS
        }
        respond @options 204
        
        # Proxy to Backend (Port 5055)
        reverse_proxy opennotebook:5055 {
            header_up X-Real-IP {remote_host}
            
            # Increase timeouts for AI processing
            transport http {
                read_timeout 300s
                write_timeout 300s
            }
        }
    }
    
    # Frontend (Port 8502) - Default handler
    handle {
        reverse_proxy opennotebook:8502
    }
    
    # File upload size for research documents
    request_body {
        max_size 100MB
    }
}

# ============================================================================
# WEBHOOK TESTING SUITE
# ============================================================================

# Webhook Tester - Debug incoming webhooks (PROTECTED!)
{$WEBHOOK_TESTER_HOSTNAME} {
    basic_auth {
        {$WEBHOOK_TESTER_USERNAME} {$WEBHOOK_TESTER_PASSWORD_HASH}
    }
    reverse_proxy webhook-tester:8080
}

# Hoppscotch - API Testing Platform (has own auth!)
{$HOPPSCOTCH_HOSTNAME} {
    # All services on different ports (AIO image)
    handle /admin* {
        reverse_proxy hoppscotch:3100
    }
    
    handle /backend* {
        reverse_proxy hoppscotch:3170
    }
    
    handle {
        reverse_proxy hoppscotch:3000
    }
    
    # WebSocket support for realtime features
    @websocket {
        header Connection *Upgrade*
        header Upgrade websocket
    }
    handle @websocket {
        reverse_proxy hoppscotch:3000
    }
}

# Uptime Kuma - Beautiful Uptime Monitoring (has own auth!)
{$UPTIME_KUMA_HOSTNAME} {
    reverse_proxy uptime-kuma:3001 {
        # WebSocket support for live monitor updates
        header_up Connection {http.request.header.Connection}
        header_up Upgrade {http.request.header.Upgrade}
        # Send real IP for logging
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
    }
    
    # Security headers
    header {
        # Enable HSTS
        Strict-Transport-Security max-age=31536000;
        # Prevent clickjacking
        X-Frame-Options SAMEORIGIN
        # Prevent content-type sniffing
        X-Content-Type-Options nosniff
    }
}

# ============================================================================
# AIRBYTE - Data Integration Platform
# ============================================================================
# Note: Airbyte has built-in authentication via abctl
# No Caddy Basic Auth needed here!
{$AIRBYTE_HOSTNAME} {
    reverse_proxy 172.18.0.1:8001
}

# ============================================
# Homepage - Dashboard
# ============================================
{$HOMEPAGE_HOSTNAME} {
    reverse_proxy homepage:3000
}

# ============================================
# Outline - Wiki
# ============================================
# Dex Identity Provider
{$DEX_HOSTNAME} {
    reverse_proxy dex:5556
}

# Outline Wiki
{$OUTLINE_HOSTNAME} {
    reverse_proxy outline:3000
}

# Outline S3 Storage
{$OUTLINE_S3_HOSTNAME} {
    reverse_proxy outline-minio:9000
}

# Outline S3 Admin
{$OUTLINE_S3_ADMIN_HOSTNAME} {
    reverse_proxy outline-minio:9001
}

# ============================================
# Gitea - Git Hosting
# ============================================
{$GITEA_HOSTNAME} {
    reverse_proxy gitea:3000
}

# ============================================
# DocuSeal - E-Signatures
# ============================================
{$DOCUSEAL_HOSTNAME} {
    reverse_proxy docuseal:3000
}

# Code-Server - VS Code in the Browser
{$CODESERVER_HOSTNAME} {
    reverse_proxy code-server:8443
}

import /etc/caddy/addons/*.conf