dotfiles/config/ansible/tasks/servers/services/caddy/Caddyfile.j2

# Global configuration for country blocking
{
    # Block specific countries (add ISO country codes as needed)
    # Examples: CN (China), RU (Russia), KP (North Korea), IR (Iran)
    servers {
        protocols h1 h2 h3
    }
}

# Country blocking snippet - reusable across all sites
{% if enable_country_blocking | default(false) and blocked_countries | default([]) | length > 0 %}
(country_block) {
    @blocked_countries {
        remote_ip {{ blocked_countries | join(' ') }}
    }
    respond @blocked_countries "Access denied from your country" 403
}
{% else %}
(country_block) {
    # Country blocking disabled
}
{% endif %}

photos.mvl.sh {
    import country_block
    reverse_proxy immich:2283
    tls {{ caddy_email }}
}

photos.vleeuwen.me {
    import country_block
    redir https://photos.mvl.sh{uri}
    tls {{ caddy_email }}
}

karakeep.mvl.sh {
    import country_block
    reverse_proxy karakeep:3000
    tls {{ caddy_email }}
}

hoarder.mvl.sh {
    import country_block
    redir https://karakeep.mvl.sh{uri}
}

git.vleeuwen.me git.mvl.sh {
    import country_block
    reverse_proxy gitea:3000
    tls {{ caddy_email }}
}

status.vleeuwen.me status.mvl.sh {
    import country_block
    reverse_proxy uptime-kuma:3001
    tls {{ caddy_email }}
}

sf.mvl.sh {
    import country_block
    reverse_proxy seafile:80

    handle /seafdav* {
        reverse_proxy seafile:8080
    }

    tls {{ caddy_email }}
}

of.mvl.sh {
    import country_block
    reverse_proxy onlyoffice:80 {
        header_up Host {host}
        header_up X-Real-IP {remote}
        header_up X-Forwarded-For {remote}
        header_up X-Forwarded-Proto {scheme}
    }
    tls {{ caddy_email }}
}

fsm.mvl.sh {
    import country_block
    reverse_proxy factorio-server-manager:80
    tls {{ caddy_email }}
}

df.mvl.sh {
    import country_block
    redir / https://git.mvl.sh/vleeuwenmenno/dotfiles/raw/branch/master/setup.sh
    tls {{ caddy_email }}
}

overseerr.mvl.sh jellyseerr.mvl.sh overseerr.vleeuwen.me jellyseerr.vleeuwen.me {
    import country_block
    reverse_proxy mennos-server:5555
    tls {{ caddy_email }}
}

jellyfin.mvl.sh jellyfin.vleeuwen.me {
    import country_block
    reverse_proxy jellyfin:8096
    tls {{ caddy_email }}
}

fladder.mvl.sh {
    import country_block
    reverse_proxy fladder:80
    tls {{ caddy_email }}
}

ip.mvl.sh {
    import country_block
    reverse_proxy echoip:8080 {
        header_up X-Real-IP {http.request.remote.host}
        header_up X-Forwarded-For {http.request.remote.host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
    }

    tls {{ caddy_email }}
}

http://ip.mvl.sh {
    import country_block
    reverse_proxy echoip:8080 {
        header_up X-Real-IP {http.request.remote.host}
        header_up X-Forwarded-For {http.request.remote.host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
    }
}