homeprod/kubernetes/infrastructure/caddy/caddyfile.yaml

# Caddy Routes - External ConfigMap
# This file contains all route definitions, imported by the main Caddyfile.
# Edit this file to add/modify routes.
#
# Certificate files are mounted from cert-manager-managed TLS Secrets
# at /etc/caddy/certs/

apiVersion: v1
kind: ConfigMap
metadata:
  name: caddy-routes
  namespace: caddy
  labels:
    app.kubernetes.io/name: caddy
    app.kubernetes.io/component: routes
data:
  Caddyfile: |
    vhaudiquet.fr {
      tls /etc/caddy/certs/vhaudiquet-fr/tls.crt /etc/caddy/certs/vhaudiquet-fr/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    *.vhaudiquet.fr {
        tls /etc/caddy/certs/wildcard-vhaudiquet-fr/tls.crt /etc/caddy/certs/wildcard-vhaudiquet-fr/tls.key

        # Kubernetes services (via Traefik)
        @authentik   host authentik.vhaudiquet.fr

        @auth-nook   host auth-nook.vhaudiquet.fr
        @nook-mg     host n.vhaudiquet.fr
        @nook        host nook.vhaudiquet.fr
        @sse-nook    host sse-nook.vhaudiquet.fr
        @inbox-nook  host inbox-nook.vhaudiquet.fr

        @gitea       host git.vhaudiquet.fr

        @flux-wh     host flux-webhook.vhaudiquet.fr

        @photos      host photos.vhaudiquet.fr

        @umami       host umami.vhaudiquet.fr

        @pkgatlas    host pkgatlas.vhaudiquet.fr

        handle @authentik {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @auth-nook {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @nook-mg {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @nook {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @sse-nook {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @inbox-nook {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @gitea {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @flux-wh {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @photos {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @umami {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @pkgatlas {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }

        # Docker VM services (via Docker Traefik)
        @alexscript     host alexscript.vhaudiquet.fr
        @clips          host clips.vhaudiquet.fr
        @jellyfin       host flix.vhaudiquet.fr

        handle @alexscript {
            reverse_proxy 10.1.2.212:80
        }
        handle @clips {
            reverse_proxy 10.1.2.212:80
        }
        handle @jellyfin {
            reverse_proxy 10.1.2.212:80
        }

        # Stalwart WebUI (now in Kubernetes, via k8s Traefik)
        @mail           host mail.vhaudiquet.fr
        handle @mail {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
    }

    semery.fr {
      tls /etc/caddy/certs/semery-fr/tls.crt /etc/caddy/certs/semery-fr/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    buildpath.win {
      tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    saggar.dev {
      tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    api.saggar.dev {
      tls /etc/caddy/certs/api-saggar-dev/tls.crt /etc/caddy/certs/api-saggar-dev/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    docs.saggar.dev {
      tls /etc/caddy/certs/docs-saggar-dev/tls.crt /etc/caddy/certs/docs-saggar-dev/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    get.saggar.dev {
      tls /etc/caddy/certs/get-saggar-dev/tls.crt /etc/caddy/certs/get-saggar-dev/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    rhema.rs {
      tls /etc/caddy/certs/rhema-rs/tls.crt /etc/caddy/certs/rhema-rs/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    www.rhema.rs {
      tls /etc/caddy/certs/www-rhema-rs/tls.crt /etc/caddy/certs/www-rhema-rs/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    get.rhema.rs {
      tls /etc/caddy/certs/get-rhema-rs/tls.crt /etc/caddy/certs/get-rhema-rs/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    s3.rhema.rs {
      tls /etc/caddy/certs/s3-rhema-rs/tls.crt /etc/caddy/certs/s3-rhema-rs/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }