import /opt/homelab/services/caddy/snippets/*.caddy
{
  email pavel123357@gmail.com

  log {
    output file /var/log/caddy/access.log
    format json
  }
}

pass.sesur.dev {
  reverse_proxy 127.0.0.1:9000
}

home.sesur.dev {
  route {
    import authentik_forward_auth
    reverse_proxy 127.0.0.1:3050
  }
}

dozzle.sesur.dev {
  route {
    import authentik_forward_auth
    reverse_proxy 127.0.0.1:9999
  }
}

photos.sesur.dev {
  log {
    output file /var/log/caddy/access.log
    format json
  }
  reverse_proxy 127.0.0.1:2283

  # Optional: allow large uploads (adjust as you like)
  request_body {
    max_size 20GB
  }
}

vault.sesur.dev {
  # Admin: allow LAN only
  @admin path /admin*
  handle @admin {
    @notlan not remote_ip 192.168.1.0/24
    respond @notlan 403
    reverse_proxy 127.0.0.1:8222
  }
  
  @negotiate path /notifications/hub/negotiate
  reverse_proxy @negotiate 127.0.0.1:8222

  # WebSocket notifications (Bitwarden clients). Must be routed to 3012.
  @hub path /notifications/hub*
  reverse_proxy @hub 127.0.0.1:3012

  # Everything else (UI + API) goes to main port.
  reverse_proxy 127.0.0.1:8222
  header {
    Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    X-Content-Type-Options "nosniff"
    Referrer-Policy "strict-origin-when-cross-origin"
  }
  log {
    output file /var/log/caddy/access.log
    format json
  }
}

http://adguard.lan {
  reverse_proxy 127.0.0.1:3000
}

http://192.168.1.47 {
  respond "i am working, master"
}

http://dozzle.lan {
  reverse_proxy 127.0.0.1:9999
}

rat.sesur.dev {
   handle /api/sub/* {
    reverse_proxy 127.0.0.1:4000
  }
  route {
    import authentik_forward_auth
    reverse_proxy 127.0.0.1:4000
  }
}

#rat-api.sesur.dev {
#   log {
#    output file /var/log/caddy/access.log
#    format json
#   }
#   @notAllowed {
#    not remote_ip 31.57.61.253
#    }
#   respond @notAllowed "Forbidden" 403
#   reverse_proxy 127.0.0.1:4000
#}

http://cyberchef.lan {
  reverse_proxy 127.0.0.1:8095
}
truenews.sesur.dev {
    root * /srv/vk-podcast-bot/data
    file_server
}
t.sesur.dev {
  root * /opt/homelab/services/mtproto_page

  handle /xk9m2p4q7/data.json {
    respond 404
  }
  handle /xk9m2p4q7/encrypt.py {
    respond 404
  }
  handle /xk9m2p4q7/*.py {
    respond 404
  }
  handle {
    file_server
  }

  header {
    X-Robots-Tag "noindex, nofollow"
    X-Content-Type-Options "nosniff"
    X-Frame-Options "DENY"
    Strict-Transport-Security "max-age=31536000"
    Referrer-Policy "no-referrer"
    Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
    Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'"
  }
  log {
    output file /var/log/caddy/access.log
    format json
  }
}
git.sesur.dev {
    log {
      output file /var/log/caddy/access.log
      format json
    }
    reverse_proxy 127.0.0.1:3001
}
arhip.sesur.dev {
    @google_verify path /google60d47e5e58fae69a.html
    handle @google_verify {
        header Content-Type text/html; charset=utf-8
        respond <<EOF
google-site-verification: google60d47e5e58fae69a.html
EOF
    }
    @robots path /robots.txt
    handle @robots {
    header Content-Type text/plain
    respond "User-agent: *\nAllow: /\nSitemap: https://arhip.sesur.dev/sitemap.xml"
    }
    # Sitemap
    @sitemap path /sitemap.xml
    handle @sitemap {
        header Content-Type application/xml
        respond <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://arhip.sesur.dev/</loc>
    <lastmod>2026-04-15</lastmod>
    <changefreq>daily</changefreq>
    <priority>1.0</priority>
  </url>
</urlset>
EOF
    }

    handle {
         header Content-Type text/html
         respond <<EOF
<!DOCTYPE html>
<html>
<body>
<h1>Arhip pidoras i shavka</h1>
<h1>hahahahh arhiiip Latiiish  &#128514;&#x1F44A;</h1>
<img src="data:image/jpeg;base64,[encoded data, 56448 characters]">
</body>
</html>
EOF
   }
}
