pack Ts too!

2026-04-15 03:35:15 +07:00
parent f59fd7a846
commit c450e297c8
3 changed files with 11 additions and 8 deletions
@@ -0,0 +1,31 @@
+# Caddy template for wakey-control-plane with Cloudflare Access.
+#
+# Security model:
+# - Public endpoints for agents: /healthz, /api/v1/agents/enroll, /api/v1/agent/ws
+# - Private admin surface: /ui/* and /api/v1/control/* (requires CF Access headers)
+#
+# Replace cp.example.com with your public control-plane domain.
+
+wakey.ldlda.com {
+    encode zstd gzip
+
+    # Public agent-facing endpoints.
+    @public path /healthz /api/v1/agents/enroll /api/v1/agent/ws
+    handle @public {
+        reverse_proxy 127.0.0.1:6767
+    }
+
+    # Admin surface requires Cloudflare Access headers.
+    @admin path /ui* /api/v1/control/*
+    @cf_access header_regexp CFJWT Cf-Access-Jwt-Assertion .+
+
+    handle @admin {
+        handle @cf_access {
+            reverse_proxy 127.0.0.1:6767
+        }
+        respond "forbidden" 403
+    }
+
+    # Deny unknown paths by default.
+    respond "not found" 404
+}