Merge branch 'master' of ssh://git.mvl.sh/vleeuwenmenno/dotfiles

ansible/tasks/servers/services/caddy/Caddyfile.j2

@@ -0,0 +1,252 @@
+# Global configuration for country blocking
+{
+    servers {
+        protocols h1 h2 h3
+    }
+}
+
+# Country blocking snippet using MaxMind GeoLocation - reusable across all sites
+{% if enable_country_blocking | default(false) and allowed_countries_codes | default([]) | length > 0 %}
+(country_block) {
+    @allowed_local {
+        remote_ip 127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 157.180.41.167 2a01:4f9:c013:1a13::1
+    }
+    @not_allowed_countries {
+        not remote_ip 127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 157.180.41.167 2a01:4f9:c013:1a13::1
+        not {
+            maxmind_geolocation {
+                db_path "/etc/caddy/geoip/GeoLite2-Country.mmdb"
+                allow_countries {{ allowed_countries_codes | join(' ') }}
+            }
+        }
+    }
+    respond @not_allowed_countries "Access denied" 403
+}
+{% else %}
+(country_block) {
+    # Country blocking disabled
+}
+{% endif %}
+
+{% if inventory_hostname == 'mennos-desktop' %}
+git.mvl.sh {
+   import country_block
+   reverse_proxy gitea:3000
+   tls {{ caddy_email }}
+}
+
+git.vleeuwen.me {
+   import country_block
+   redir https://git.mvl.sh{uri}
+   tls {{ caddy_email }}
+}
+
+df.mvl.sh {
+   import country_block
+   redir / https://git.mvl.sh/vleeuwenmenno/dotfiles/raw/branch/master/setup.sh
+   tls {{ caddy_email }}
+}
+
+fsm.mvl.sh {
+   import country_block
+   reverse_proxy factorio-server-manager:80
+   tls {{ caddy_email }}
+}
+
+fsm.vleeuwen.me {
+   import country_block
+   redir https://fsm.mvl.sh{uri}
+   tls {{ caddy_email }}
+}
+
+beszel.mvl.sh {
+   import country_block
+   reverse_proxy beszel:8090
+   tls {{ caddy_email }}
+}
+
+beszel.vleeuwen.me {
+   import country_block
+   redir https://beszel.mvl.sh{uri}
+   tls {{ caddy_email }}
+}
+
+photos.mvl.sh {
+   import country_block
+   reverse_proxy immich:2283
+   tls {{ caddy_email }}
+}
+
+photos.vleeuwen.me {
+   import country_block
+   redir https://photos.mvl.sh{uri}
+   tls {{ caddy_email }}
+}
+
+home.mvl.sh {
+   import country_block
+   reverse_proxy host.docker.internal:8123 {
+       header_up Host {upstream_hostport}
+       header_up X-Real-IP {http.request.remote.host}
+   }
+   tls {{ caddy_email }}
+}
+
+home.vleeuwen.me {
+   import country_block
+   reverse_proxy host.docker.internal:8123 {
+       header_up Host {upstream_hostport}
+       header_up X-Real-IP {http.request.remote.host}
+   }
+   tls {{ caddy_email }}
+}
+
+
+unifi.mvl.sh {
+    reverse_proxy unifi-controller:8443 {
+        transport http {
+            tls_insecure_skip_verify
+        }
+        header_up Host {host}
+    }
+    tls {{ caddy_email }}
+}
+
+hotspot.mvl.sh {
+    reverse_proxy unifi-controller:8843 {
+        transport http {
+            tls_insecure_skip_verify
+        }
+        header_up Host {host}
+    }
+    tls {{ caddy_email }}
+}
+
+hotspot.mvl.sh:80 {
+    redir https://hotspot.mvl.sh{uri} permanent
+}
+
+bin.mvl.sh {
+   import country_block
+   reverse_proxy privatebin:8080
+   tls {{ caddy_email }}
+}
+
+ip.mvl.sh ip.vleeuwen.me {
+   import country_block
+   reverse_proxy echoip:8080 {
+       header_up X-Real-IP {http.request.remote.host}
+   }
+   tls {{ caddy_email }}
+}
+
+http://ip.mvl.sh http://ip.vleeuwen.me {
+   import country_block
+   reverse_proxy echoip:8080 {
+       header_up X-Real-IP {http.request.remote.host}
+   }
+}
+
+overseerr.mvl.sh {
+   import country_block
+   reverse_proxy overseerr:5055
+   tls {{ caddy_email }}
+}
+
+overseerr.vleeuwen.me {
+   import country_block
+   redir https://overseerr.mvl.sh{uri}
+   tls {{ caddy_email }}
+}
+
+plex.mvl.sh {
+   import country_block
+   reverse_proxy host.docker.internal:32400 {
+       header_up Host {upstream_hostport}
+       header_up X-Real-IP {http.request.remote.host}
+   }
+   tls {{ caddy_email }}
+}
+
+plex.vleeuwen.me {
+   import country_block
+   redir https://plex.mvl.sh{uri}
+   tls {{ caddy_email }}
+}
+
+tautulli.mvl.sh {
+   import country_block
+   reverse_proxy host.docker.internal:8181 {
+       header_up Host {upstream_hostport}
+       header_up X-Real-IP {http.request.remote.host}
+   }
+   tls {{ caddy_email }}
+}
+
+tautulli.vleeuwen.me {
+   import country_block
+   redir https://tautulli.mvl.sh{uri}
+   tls {{ caddy_email }}
+}
+
+cloud.mvl.sh {
+   import country_block
+   reverse_proxy cloudreve:5212 {
+       header_up Host {host}
+       header_up X-Real-IP {http.request.remote.host}
+   }
+   tls {{ caddy_email }}
+}
+
+cloud.vleeuwen.me {
+  import country_block
+  redir https://cloud.mvl.sh{uri}
+  tls {{ caddy_email }}
+}
+
+collabora.mvl.sh {
+  import country_block
+  reverse_proxy collabora:9980 {
+    header_up Host {host}
+    header_up X-Real-IP {http.request.remote.host}
+  }
+  tls {{ caddy_email }}
+}
+
+drive.mvl.sh drive.vleeuwen.me {
+   import country_block
+
+   # CalDAV and CardDAV redirects
+   redir /.well-known/carddav /remote.php/dav/ 301
+   redir /.well-known/caldav /remote.php/dav/ 301
+
+   # Handle other .well-known requests
+   handle /.well-known/* {
+       reverse_proxy nextcloud:80 {
+           header_up Host {host}
+           header_up X-Real-IP {http.request.remote.host}
+       }
+   }
+
+   # Main reverse proxy configuration with proper headers
+   reverse_proxy nextcloud:80 {
+       header_up Host {host}
+       header_up X-Real-IP {http.request.remote.host}
+   }
+
+   # Security headers
+   header {
+       # HSTS header for enhanced security (required by Nextcloud)
+       Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+       # Additional security headers recommended for Nextcloud
+       X-Content-Type-Options "nosniff"
+       X-Frame-Options "SAMEORIGIN"
+       Referrer-Policy "no-referrer"
+       X-XSS-Protection "1; mode=block"
+       X-Permitted-Cross-Domain-Policies "none"
+       X-Robots-Tag "noindex, nofollow"
+   }
+
+   tls {{ caddy_email }}
+}
+{% endif %}

ansible/tasks/servers/services/caddy/Dockerfile

@@ -0,0 +1,15 @@
+FROM caddy:2.9.1-builder AS builder
+
+RUN xcaddy build \
+    --with github.com/porech/caddy-maxmind-geolocation
+
+FROM caddy:2.9.1-alpine
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+
+# Create directory for MaxMind databases and logs
+RUN mkdir -p /etc/caddy/geoip /var/log/caddy
+
+EXPOSE 80 443
+
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

ansible/tasks/servers/services/caddy/caddy.yml

@@ -0,0 +1,59 @@
+---
+- name: Deploy Caddy service
+  block:
+    - name: Set Caddy directories
+      ansible.builtin.set_fact:
+        caddy_service_dir: "{{ ansible_env.HOME }}/.services/caddy"
+        caddy_data_dir: "/mnt/services/caddy"
+        geoip_db_path: "/mnt/services/echoip"
+        caddy_email: "{{ lookup('community.general.onepassword', 'Caddy (Proxy)', vault='Dotfiles', field='email') }}"
+
+    - name: Create Caddy directory
+      ansible.builtin.file:
+        path: "{{ caddy_service_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Setup country blocking
+      ansible.builtin.include_tasks: country-blocking.yml
+
+    - name: Copy Dockerfile for custom Caddy build
+      ansible.builtin.copy:
+        src: Dockerfile
+        dest: "{{ caddy_service_dir }}/Dockerfile"
+        mode: "0644"
+      register: caddy_dockerfile
+
+    - name: Create Caddy network
+      ansible.builtin.command: docker network create caddy_default
+      register: create_caddy_network
+      failed_when:
+        - create_caddy_network.rc != 0
+        - "'already exists' not in create_caddy_network.stderr"
+      changed_when: create_caddy_network.rc == 0
+
+    - name: Deploy Caddy docker-compose.yml
+      ansible.builtin.template:
+        src: docker-compose.yml.j2
+        dest: "{{ caddy_service_dir }}/docker-compose.yml"
+        mode: "0644"
+      register: caddy_compose
+
+    - name: Deploy Caddy Caddyfile
+      ansible.builtin.template:
+        src: Caddyfile.j2
+        dest: "{{ caddy_service_dir }}/Caddyfile"
+        mode: "0644"
+      register: caddy_file
+
+    - name: Stop Caddy service
+      ansible.builtin.command: docker compose -f "{{ caddy_service_dir }}/docker-compose.yml" down --remove-orphans
+      when: caddy_compose.changed or caddy_file.changed
+
+    - name: Start Caddy service
+      ansible.builtin.command: docker compose -f "{{ caddy_service_dir }}/docker-compose.yml" up -d
+      when: caddy_compose.changed or caddy_file.changed
+  tags:
+    - caddy
+    - services
+    - reverse-proxy

ansible/tasks/servers/services/caddy/country-blocking.yml

@@ -0,0 +1,50 @@
+---
+- name: Country blocking setup for Caddy with MaxMind GeoLocation
+  block:
+      - name: Copy Dockerfile for custom Caddy build with GeoIP
+        ansible.builtin.copy:
+            src: Dockerfile
+            dest: "{{ caddy_service_dir }}/Dockerfile"
+            mode: "0644"
+        when: enable_country_blocking | default(false)
+
+      - name: Check if MaxMind Country database is available
+        ansible.builtin.stat:
+            path: "{{ geoip_db_path }}/GeoLite2-Country.mmdb"
+        register: maxmind_country_db
+        when: enable_country_blocking | default(false)
+
+      - name: Ensure log directory exists for Caddy
+        ansible.builtin.file:
+            path: "{{ caddy_data_dir }}/logs"
+            state: directory
+            mode: "0755"
+        become: true
+        when: enable_country_blocking | default(false)
+
+      - name: Display country blocking configuration
+        ansible.builtin.debug:
+            msg:
+                - "✅ Country blocking enabled: {{ enable_country_blocking | default(false) }}"
+                - "🛡️  Countries to allow: {{ allowed_countries_codes | default([]) | join(', ') }}"
+                - "📍 Using MaxMind GeoLocation plugin"
+                - "💾 Database path: /etc/caddy/geoip/GeoLite2-Country.mmdb"
+                - "📊 Database available: {{ maxmind_country_db.stat.exists | default(false) }}"
+        when: enable_country_blocking | default(false)
+
+      - name: Warn if MaxMind database not found
+        ansible.builtin.debug:
+            msg:
+                - "⚠️  WARNING: MaxMind Country database not found!"
+                - "Expected location: {{ geoip_db_path }}/GeoLite2-Country.mmdb"
+                - "Country blocking will not work until EchoIP service is deployed"
+                - "Run: dotf update --ansible --tags echoip"
+        when:
+            - enable_country_blocking | default(false)
+            - not maxmind_country_db.stat.exists | default(false)
+
+  tags:
+      - caddy
+      - security
+      - country-blocking
+      - geoip

ansible/tasks/servers/services/caddy/docker-compose.yml.j2

@@ -0,0 +1,32 @@
+services:
+  caddy:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - {{ caddy_data_dir }}/data:/data
+      - {{ caddy_data_dir }}/config:/config
+      - {{ caddy_service_dir }}/Caddyfile:/etc/caddy/Caddyfile
+      - {{ geoip_db_path }}:/etc/caddy/geoip:ro
+      - {{ caddy_data_dir }}/logs:/var/log/caddy
+    environment:
+      - TZ=Europe/Amsterdam
+      - PUID=1000
+      - PGID=100
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    networks:
+      - caddy_network
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+
+networks:
+  caddy_network:
+    name: caddy_default
+    enable_ipv6: true