33 lines
1.0 KiB
Caddyfile
33 lines
1.0 KiB
Caddyfile
# Caddy template for wakey-control-plane with Cloudflare Access.
|
|
#
|
|
# Security model:
|
|
# - Public endpoints for agents: health, enrollment, control WS, and scoped terminal relay WS
|
|
# - Private admin surface: root, /ui/* and /api/v1/control/* (verified Access JWT)
|
|
# Configure CC's [access] section and loopback bind before enabling this template.
|
|
# Never expose /internal/auth/verify through this virtual host.
|
|
#
|
|
# Replace wakey.ldlda.com and the loopback upstream port for your deployment.
|
|
|
|
wakey.ldlda.com {
|
|
encode zstd gzip
|
|
|
|
# Public agent-facing endpoints.
|
|
@public path /healthz /api/v1/agents/enroll /api/v1/agent/ws /api/v1/agent/terminals/*
|
|
handle @public {
|
|
reverse_proxy 127.0.0.1:6767
|
|
}
|
|
|
|
# Applies to HTTP requests and operator WebSocket upgrades, not WS frames.
|
|
@admin path / /ui* /api/v1/control/*
|
|
|
|
handle @admin {
|
|
forward_auth 127.0.0.1:6767 {
|
|
uri /internal/auth/verify
|
|
}
|
|
reverse_proxy 127.0.0.1:6767
|
|
}
|
|
|
|
# Deny unknown paths by default.
|
|
respond "not found" 404
|
|
}
|