Caddyfile

{
	http_port 8888

	security {
		oauth identity provider github {env.GITHUB_CLIENT_ID} {env.GITHUB_CLIENT_SECRET}

		local identity store localdb {
			realm local
			path {$HOME}/.local/caddy/users.json
		}

		authentication portal myportal {
			enable identity store localdb
			enable identity provider github
			crypto default token lifetime 3600
			cookie domain *
			cookie insecure on
			ui {
				links {
					"IDE" /ide/ icon "las la-terminal"
					"IPFS GUI" /webui/ icon "las la-star"
					"GLANCES" /glances/ icon "las la-tachometer-alt"
					"CADVISOR" /cadvisor/containers/ icon "las la-chart-line"
					"PROMETHEUS" /prometheus/graph icon "las la-archive"
					"GRAFANA" /grafana icon "las la-info"
				}
			}

			transform user {
				match realm github
				match sub github.com/TtheBC01
				action add role authp/admin
			}
		}

		authorization policy admins_policy {
			set auth url /auth
			crypto default token lifetime 3600
			allow roles authp/admin
			inject headers with claims
		}
	}
}

:2222 {
	metrics /metrics
}

:8888 {
	log
	route /auth* {
		authenticate with myportal
	}

	route /ide* {
		authorize with admins_policy
		uri strip_prefix /ide
		reverse_proxy http://127.0.0.1:8080
	}

	route /glances* {
		authorize with admins_policy
		uri strip_prefix /glances
		reverse_proxy http://glances:61208
	}

	route /ipfs* {
		authorize with admins_policy
		reverse_proxy http://ipfs_node:5001
	}

	route /api* {
		authorize with admins_policy
		reverse_proxy http://ipfs_node:5001
	}

	handle_path /gateway/* {
		reverse_proxy http://ipfs_node:8080
	}

	route /webui* {
		authorize with admins_policy
		reverse_proxy http://ipfs_node:5001
	}

	route /cadvisor* {
		authorize with admins_policy
		reverse_proxy http://cadvisor:8080
	}

	route /prometheus* {
		authorize with admins_policy
		uri strip_prefix /prometheus
		reverse_proxy http://prometheus:9090
	}

	route /grafana* {
		authorize with admins_policy
		uri strip_prefix /grafana
		reverse_proxy http://grafana:3000
	}

	route {
		redir https://{hostport}/auth/ 302
	}
}