add more confs and stuff

alpine/caddy/Caddyfile

@@ -0,0 +1,126 @@
+{
+    auto_https off
+    order crowdsec first
+    order rate_limit before crowdsec
+    servers {
+        timeouts {
+            read_body   60m
+            read_header 10s
+            write        0s
+            idle        120s
+        }
+        max_header_size 64kb
+    }
+    crowdsec {
+        api_url http://crowdsec:8080
+        api_key xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+        ticker_interval 15s
+        disable_streaming
+        enable_hard_fails
+    }
+}
+
+(rate_limit_strict) {
+    rate_limit {
+        zone strict {
+            key    {client_ip}
+            events 5000
+            window 1m
+        }
+    }
+}
+
+(rate_limit_login) {
+    rate_limit {
+        zone login {
+            key    {client_ip}
+            events 500
+            window 5m
+        }
+    }
+}
+
+(security_headers) {
+    header {
+        X-Content-Type-Options nosniff
+        X-Frame-Options SAMEORIGIN
+        Referrer-Policy no-referrer
+        X-Permitted-Cross-Domain-Policies none
+        -Server
+    }
+}
+
+(access_log) {
+    log {
+        output file /var/log/caddy/access.log {
+            roll_size 100mb
+            roll_keep 5
+        }
+        format json
+    }
+}
+
+http://vacpro.fyi {
+    import access_log
+    import security_headers
+    import rate_limit_strict
+    redir http://moxiu.vacpro.fyi{uri}
+}
+
+http://moxiu.vacpro.fyi {
+    import access_log
+    import security_headers
+    import rate_limit_strict
+    reverse_proxy 172.17.0.1:3001
+}  
+
+http://photos.vacpro.fyi {
+    import access_log
+    import security_headers
+    import rate_limit_strict
+    reverse_proxy immich_server:2283 {
+        header_up X-Forwarded-For {client_ip}
+        header_up X-Forwarded-Proto https
+        header_up X-Real-IP {client_ip}
+        header_up Host {host}
+    }
+}
+
+http://zita.vacpro.fyi {
+    import access_log
+    import security_headers
+    import rate_limit_login
+    reverse_proxy zitadel-proxy-1:80 {
+        header_up X-Forwarded-For {client_ip}
+        header_up X-Forwarded-Proto https
+        header_up X-Forwarded-Host {host}
+        header_up X-Real-IP {client_ip}
+        header_up Host {host}
+    }
+}
+
+http://vw.vacpro.fyi {
+    import access_log
+    import security_headers
+    import rate_limit_login
+    reverse_proxy vaultwarden:80 {
+        header_up X-Forwarded-For {client_ip}
+        header_up X-Forwarded-Proto https
+        header_up X-Forwarded-Host {host}
+        header_up X-Real-IP {client_ip}
+        header_up Host {host}
+    }
+}
+
+http://zip.vacpro.fyi {
+    request_body {
+        max_size 200GB
+    }
+    reverse_proxy zipline:3000 {
+        header_up X-Forwarded-For {client_ip}
+        header_up X-Forwarded-Proto https
+        header_up X-Forwarded-Host {host}
+        header_up X-Real-IP {client_ip}
+        header_up Host {host}
+    }
+}

alpine/caddy/Dockerfile

@@ -0,0 +1,8 @@
+FROM caddy:builder AS builder
+RUN xcaddy build \
+    --with github.com/hslatman/caddy-crowdsec-bouncer/http \
+    --with github.com/mholt/caddy-ratelimit
+
+FROM caddy:latest
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY Caddyfile /etc/caddy/Caddyfile

alpine/caddy/crowdsec/acquis.yaml

@@ -0,0 +1,10 @@
+filenames:
+  - /var/log/caddy/*.log
+labels:
+  type: caddy
+---
+source: docker
+container_name:
+  - nextcloud
+labels:
+  type: nextcloud

alpine/caddy/docker-compose.yml

@@ -0,0 +1,66 @@
+services:
+  crowdsec:
+    image: crowdsecurity/crowdsec:latest
+    restart: always
+    environment:
+      GID: "1000"
+      COLLECTIONS: crowdsecurity/caddy crowdsecurity/linux crowdsecurity/nextcloud
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - crowdsec_db:/var/lib/crowdsec/data
+      - caddy_logs:/var/log/caddy:ro
+    networks:
+      - proxy
+    healthcheck:
+      test: ["CMD", "cscli", "version"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  caddy:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - caddy_data:/data
+      - caddy_config:/config
+      - caddy_logs:/var/log/caddy
+    environment:
+      CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
+    depends_on:
+      crowdsec:
+        condition: service_healthy
+    networks:
+      - proxy
+      - immich_default
+      - zitadel
+      - vw_default
+      - zipline_default
+
+volumes:
+  crowdsec_db:
+  caddy_data:
+  caddy_config:
+  caddy_logs:
+
+networks:
+  proxy:
+    driver: bridge
+  immich_default:
+    external: true
+    name: immich_default
+  zitadel:
+    external: true
+    name: zitadel
+  vw_default:
+    external: true
+    name: vw_default
+  zipline_default:
+    external: true
+    name: zipline_default