Standardize Caddy route headers across all services #27

New issue

Open

opened 2026-07-25 19:37:14 +00:00 by lab · 0 comments

lab commented

2026-07-25 19:37:14 +00:00

Owner

Some Caddy routes use the full header set (X-Forwarded-Uri, transport block) while others don't. Standardize all routes to use the "standard service" template from caddy-crowdsec.md.

Current inconsistencies:

portfolio.yukselcloud.com — no headers at all
keycloak.yukselcloud.com — raw IP, no headers
ldap.yukselcloud.com — no headers
vaultwarden.yukselcloud.com — raw IP, no headers
ntfy.yukselcloud.com — missing X-Forwarded-Host, X-Forwarded-Uri
changedetection.yukselcloud.com — missing X-Forwarded-Host, X-Forwarded-Uri

Add forward_auth to services that should require authentication (Kubernetes Dashboard, Longhorn UI, Homer, Homarr).

Update (2026-08-01)

New services joining from the lightweight monitoring work (see #11, #41) need routes with the standard header set:

`beszel.yukselcloud.com` -- full headers + `forward_auth` (Beszel hub, no anonymous access)
`kuma.yukselcloud.com` (Uptime Kuma) -- full headers + `forward_auth` unless status page is made public (see #41)

Add both to the existing standardization pass.

Some Caddy routes use the full header set (`X-Forwarded-Uri`, `transport` block) while others don't. Standardize all routes to use the "standard service" template from `caddy-crowdsec.md`. Current inconsistencies: - `portfolio.yukselcloud.com` — no headers at all - `keycloak.yukselcloud.com` — raw IP, no headers - `ldap.yukselcloud.com` — no headers - `vaultwarden.yukselcloud.com` — raw IP, no headers - `ntfy.yukselcloud.com` — missing `X-Forwarded-Host`, `X-Forwarded-Uri` - `changedetection.yukselcloud.com` — missing `X-Forwarded-Host`, `X-Forwarded-Uri` Add `forward_auth` to services that should require authentication (Kubernetes Dashboard, Longhorn UI, Homer, Homarr). ## Update (2026-08-01) New services joining from the lightweight monitoring work (see #11, #41) need routes with the standard header set: - \`beszel.yukselcloud.com\` -- full headers + \`forward_auth\` (Beszel hub, no anonymous access) - \`kuma.yukselcloud.com\` (Uptime Kuma) -- full headers + \`forward_auth\` unless status page is made public (see #41) Add both to the existing standardization pass.