{
	log default {
		output stdout
		format json
		include http.log.access tls
	}

	metrics

	servers {
		trusted_proxies static private_ranges {{ trusted_proxies }}
		trusted_proxies_strict
	}

	tailscale {
		auth_key {env.TS_AUTHKEY}
		state_dir /data/tailscale
	}
}

### Auth

# https://www.authelia.com/integration/proxies/caddy/#forwarded-header-trust#trusted-proxies
(trusted_proxy_list) {
	trusted_proxies {{ trusted_proxies }}
}

# Tailnet-bound sites: internal TLS, a dedicated tailscale node, and access
# logging routed to the default logger (shipped to VictoriaLogs via Vector).
# tsauth additionally gates on tailscale identity.
(ts) {
	tls internal
	bind tailscale/{args[0]}
	log
}

# Gates on tailscale identity; headers overwrite client-sent values. Apps
# can override Remote-User with header_up where they match another value.
(tsident) {
	tailscale_auth
	map {http.auth.user.tailscale_user} {ts_slug} {
{% for login, slug in (tailscale.slugs | from_yaml).items() %}
		{{ login }} {{ slug }}
{% endfor %}
		default {http.auth.user.tailscale_login}
	}
	request_header Remote-User {http.auth.user.tailscale_user}
	request_header X-User-Slug {ts_slug}
}

(tsauth) {
	import ts {args[0]}
	import tsident
}

{% for domain in ("kejadlen.dev", "chislan.family") %}
auth.{{ domain }} {
	log

	reverse_proxy authelia:9091 {
		import trusted_proxy_list
	}
}
{% endfor %}

http://setup {
	bind tailscale/setup
	log
	file_server {
		root /data/setup
	}
}

### Monitoring

cadvisor {
	import ts cadvisor
	reverse_proxy cadvisor:8080
}

grafana {
	import tsauth grafana
	reverse_proxy grafana:3000 {
		header_up X-Webauth-User {http.auth.user.tailscale_user}
	}
}

:2019 {
	metrics /metrics
}

logs {
	import ts logs
	reverse_proxy victoria-logs:9428
}

traces {
	import ts traces
	reverse_proxy victoria-traces:10428
}

# need scheme here since `metrics` is a directive
https://metrics {
	import ts metrics
	reverse_proxy victoria-metrics:8428
}

### Services

quire {
	import tsauth quire
	reverse_proxy quire:3000 {
		header_up Remote-User {http.auth.user.tailscale_login}
	}
}

irc {
	import tsauth irc

	file_server
	root * /data/gamja/dist

	reverse_proxy /socket soju:3030
}

rss {
	import tsauth rss
	reverse_proxy miniflux:8080 {
		header_up Remote-User {http.auth.user.tailscale_login}
	}
}

ketchup {
	import tsauth ketchup
	reverse_proxy ketchup:9292 {
		header_up Tailscale-User-Login {http.auth.user.tailscale_login}
		header_up Tailscale-User-Name {http.auth.user.tailscale_user}
	}
}

docket {
	import tsauth docket
	reverse_proxy docket:3000
}

### Family

books {
	import tsauth books
	reverse_proxy calibre-web:8083 {
		header_up Remote-User {http.auth.user.tailscale_user}
	}
}

contacts.chislan.family {
	bind tailscale/contacts
	log
	tls {
		dns dnsimple {env.DNSIMPLE_API_ACCESS_TOKEN}
	}
	import tsident

	reverse_proxy pro-tacts:9292 {
		header_up Remote-User {http.auth.user.tailscale_user}
	}
}

docs {
	import tsauth docs
	reverse_proxy paperless-ngx:8000 {
		header_up Remote-User {http.auth.user.tailscale_user}
	}

	redir /flower /flower/
	handle /flower/* {
		reverse_proxy paperless-ngx:5555
	}
}

homebox {
	import ts homebox
	reverse_proxy homebox:7745
}

### Internal

dockhand {
	import tsauth dockhand
	reverse_proxy dockhand:3000
}

home-assistant-509 {
	import ts home-assistant-509
	reverse_proxy homeassistant-509:8123
}

home-assistant-5119 {
	import ts home-assistant-5119
	reverse_proxy homeassistant-5119:8123
}

pihole {
	import ts pihole

	redir / /admin/
	reverse_proxy mountain-of-faith:80
}

### External

# synced from quire/gists
gists.kejadlen.dev {
	log

	root * /data/gists
	encode zstd gzip

	# raw markdown, like GitHub's raw view
	@raw path *.md
	handle @raw {
		file_server
	}

	# rendered views; templates stays scoped here so raw .md is never evaluated
	handle {
		rewrite * /_render.html
		templates
		file_server
	}
}

birbs.chislan.family {
	log

	reverse_proxy hopeless-masquerade:80
}

files.chislan.family {
	root /data/files
	file_server
}

git.kejadlen.dev {
	log

	# Meta's web indexer hammers gitea's blame/diff endpoints hard enough
	# to spike load; throttle it to one request per minute per source IP.
	rate_limit {
		zone meta_webindexer {
			match {
				header User-Agent meta-webindexer/*
			}
			key {http.request.remote.host}
			events 1
			window 1m
			log_key
		}
	}

	# hacky way to reverse auth only from my laptop
	# remote_ip, not client_ip: any container can forge X-Forwarded-For.
	@undefined-fantastic-object remote_ip {{ undefined_fantastic_object_ip }}
	reverse_proxy @undefined-fantastic-object gitea:3000 {
		header_up X-Webauth-User alpha
	}

	# Gitea trusts X-Webauth-User from caddy, so never pass a client's through.
	reverse_proxy anubis:8923 {
		header_up X-Real-Ip {remote_host}
		header_up -X-Webauth-User
	}
}

hey.kejadlen.dev {
	log

	reverse_proxy gotosocial:8080

	handle /metrics {
		respond 404
	}
}

monica.kejadlen.dev {
	log

	reverse_proxy monica:80
}

quire.kejadlen.dev {
	reverse_proxy quire:3000
}

# vim: ts=4