From ae318aedcafc9323f2de4c13d281b21b34b918bf Mon Sep 17 00:00:00 2001
From: g4st3r <g4st3r@localhost>
Date: Sat, 7 Mar 2026 22:36:02 +0300
Subject: [PATCH] Init reverse-proxy Caddy config

---
 .gitignore        |   2 +
 Caddyfile         | 118 ++++++++++++++++++++++++++++++++++++++++++++++
 README.md         |  14 ++++++
 caddy.env.example |   1 +
 4 files changed, 135 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 Caddyfile
 create mode 100644 README.md
 create mode 100644 caddy.env.example

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c203fed
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+caddy.env
+*.log
diff --git a/Caddyfile b/Caddyfile
new file mode 100644
index 0000000..da308c3
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,118 @@
+{
+	admin localhost:2019
+}
+
+# --- Сниппеты ---
+(hsts) {
+	header {
+		Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
+	}
+}
+
+(enc) {
+	encode gzip zstd
+}
+
+(proxy-common) {
+	header_up Host {host}
+	header_up X-Forwarded-Proto {scheme}
+}
+
+# --- Сайты ---
+s3.g4st3r.ru {
+	reverse_proxy 10.8.0.2:9000 {
+		import proxy-common
+	}
+	import hsts
+	import enc
+}
+
+minio.g4st3r.ru {
+	reverse_proxy 10.8.0.2:9110 {
+		import proxy-common
+	}
+	import hsts
+	import enc
+}
+
+cloud.g4st3r.ru {
+	reverse_proxy 10.8.0.2:80 {
+		import proxy-common
+	}
+	import hsts
+	import enc
+}
+
+grafana.g4st3r.ru {
+	reverse_proxy 10.8.0.2:3000 {
+		import proxy-common
+	}
+	import hsts
+	import enc
+}
+
+prometheus.g4st3r.ru {
+	reverse_proxy 10.8.0.2:9090 {
+		import proxy-common
+	}
+	import hsts
+	import enc
+}
+
+alert.g4st3r.ru {
+	reverse_proxy 10.8.0.2:9093 {
+		import proxy-common
+	}
+	import hsts
+	import enc
+}
+
+photos.g4st3r.ru {
+	reverse_proxy 10.8.0.2:2283 {
+		import proxy-common
+		header_up X-Real-IP {remote}
+	}
+	# Immich не поддерживает subpath — только корень домена/поддомена
+	request_body {
+		max_size 50000MB
+	}
+	import hsts
+	import enc
+}
+
+home.g4st3r.ru {
+	reverse_proxy 10.8.0.2:8123 {
+		import proxy-common
+	}
+	import hsts
+	import enc
+}
+
+gitlab.g4st3r.ru {
+	reverse_proxy 10.8.0.2:9443 {
+		transport http {
+			tls_insecure_skip_verify
+		}
+		import proxy-common
+	}
+}
+
+openclaw.g4st3r.ru {
+	reverse_proxy 10.8.0.2:18789 {
+		import proxy-common
+		header_up Authorization "Bearer {env.OPENCLAW_GATEWAY_TOKEN}"
+	}
+}
+
+git.g4st3r.ru {
+	reverse_proxy 10.8.0.2:2222 {
+		import proxy-common
+	}
+	tls aporyadin003@gmail.com
+}
+
+bw.g4st3r.ru {
+	reverse_proxy 10.8.0.2:8087 {
+		import proxy-common
+	}
+}
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..7f71cfa
--- /dev/null
+++ b/README.md
@@ -0,0 +1,14 @@
+# reverse-proxy
+
+Caddy config for g4st3r reverse proxy.
+
+## Files
+- Caddyfile
+- caddy.env (local only, not committed)
+- caddy.env.example
+
+## Reload
+sudo systemctl restart caddy
+
+## Note
+openclaw.g4st3r.ru uses Authorization header from env: OPENCLAW_GATEWAY_TOKEN.
diff --git a/caddy.env.example b/caddy.env.example
new file mode 100644
index 0000000..899ba1d
--- /dev/null
+++ b/caddy.env.example
@@ -0,0 +1 @@
+OPENCLAW_GATEWAY_TOKEN=