root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Caddy routing and add caddy_net to all Docker services

Browse Source 
- lib/common.sh: fix broken reverse_proxy target — localhost inside Caddy's
  container is the container's own loopback, not the host; change to
  host.docker.internal so proxied ports are actually reachable
- services/caddy.sh: add extra_hosts host.docker.internal:host-gateway so
  the above resolves correctly; create caddy_net bridge network in Caddy's
  own compose so other services can reference it as external; update all
  Caddyfile template comments and README examples to match
- services/filebrowser.sh: update image tag from deprecated :s6 to :latest;
  remove non-functional PUID/PGID env vars (filebrowser/filebrowser does not
  honour them); add configure_caddy_for_service call; add caddy_net
- services/ntfy.sh: add configure_caddy_for_service call; add caddy_net
- services/portainer.sh: add configure_caddy_for_service call; add caddy_net
- services/frigate-notify.sh, watchtower.sh: add caddy_net for
  container-to-container comms (frigate, ntfy) without a Caddy call
- All remaining web-facing Docker services: add caddy_net network block to
  docker-compose and CADDY_NET to .env where applicable; services using
  network_mode: host (wolf-pair, lyrion) have the top-level block only

https://claude.ai/code/session_01UZus2Q9gNTfUdqSMrhuX29
This commit is contained in:
Claude
2026-06-07 22:02:26 +00:00
parent a5a61da714
commit 56bec03c9b
26 changed files with 210 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/common.sh
+1 -1
View File
@@ -320,7 +320,7 @@ configure_caddy_for_service() {
# $SERVICE_NAME
$SERVICE_DOMAIN {
reverse_proxy localhost:$SERVICE_PORT
reverse_proxy host.docker.internal:$SERVICE_PORT
# Security headers
header {
services/actualbudget.sh
+8
View File
@@ -40,10 +40,18 @@ services:
- ./data:/data
env_file:
- .env
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
AB_COMPOSE
cat > .env << AB_ENV
TZ=$TZ_VAL
CADDY_NET=$SITE_CADDY_NET
AB_ENV
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$AB_DIR"
services/arm.sh
+8
View File
@@ -73,10 +73,18 @@ services:
# Add more optical drives as needed:
# - /dev/sr1:/dev/sr1
privileged: true
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
ARM_COMPOSE
cat > .env << ARM_ENV
ARM_OUTPUT=$ARM_OUTPUT
CADDY_NET=$SITE_CADDY_NET
ARM_ENV
mkdir -p config logs
services/audiobookshelf.sh
+8
View File
@@ -50,11 +50,19 @@ services:
- \${PODCASTS_PATH:-./podcasts}:/podcasts
ports:
- "13378:80"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
ABS_COMPOSE
cat > .env << ABS_ENV
AUDIOBOOKS_PATH=$AUDIOBOOKS_PATH
PODCASTS_PATH=./podcasts
CADDY_NET=$SITE_CADDY_NET
ABS_ENV
mkdir -p config metadata podcasts
services/caddy.sh
+12 -3
View File
@@ -82,6 +82,15 @@ services:
- ACME_AGREE=true
labels:
- "io.podman.annotations.label/crowdsec.enable=true"
extra_hosts:
- "host.docker.internal:host-gateway"
networks:
- caddy_net
networks:
caddy_net:
driver: bridge
name: caddy_net
CADDY_COMPOSE
# Create Caddyfile if it doesn't exist
@@ -114,7 +123,7 @@ CADDY_COMPOSE
# Example:
# myservice.yourdomain.com {
# import authelia
# reverse_proxy localhost:PORT
# reverse_proxy host.docker.internal:PORT
# }
# ActualBudget
@@ -124,7 +133,7 @@ CADDY_COMPOSE
# format json
# level INFO
# }
# reverse_proxy localhost:5006
# reverse_proxy host.docker.internal:5006
# header {
# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# X-Frame-Options "SAMEORIGIN"
@@ -165,7 +174,7 @@ a web service). You can also edit it by hand:
```
myservice.example.com {
reverse_proxy localhost:1234
reverse_proxy host.docker.internal:1234
log {
output file /var/log/caddy/myservice.example.com.log
format json
services/emby.sh
+8
View File
@@ -59,10 +59,18 @@ services:
# Uncomment for hardware transcoding (Intel/AMD):
# devices:
# - /dev/dri:/dev/dri
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
EMBY_COMPOSE
cat > .env << EMBY_ENV
MEDIA_PATH=$MEDIA_PATH
CADDY_NET=$SITE_CADDY_NET
EMBY_ENV
mkdir -p config
services/filebrowser.sh
+11 -3
View File
@@ -26,13 +26,11 @@ name: filebrowser
services:
filebrowser:
image: filebrowser/filebrowser:s6
image: filebrowser/filebrowser:latest
container_name: filebrowser
hostname: filebrowser
restart: unless-stopped
environment:
- PUID=$(id -u "$ACTUAL_USER")
- PGID=$(id -g "$ACTUAL_USER")
- TZ=${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}
volumes:
- ${FB_PATH}:/srv
@@ -40,10 +38,18 @@ services:
- ./config/settings.json:/config/settings.json
ports:
- "8085:80"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
FB_COMPOSE
cat > .env << FB_ENV
FB_PATH=$FB_PATH
CADDY_NET=$SITE_CADDY_NET
FB_ENV
mkdir -p database config
@@ -64,6 +70,8 @@ FB_SETTINGS
echo ""
log_success "Filebrowser configured at $FB_DIR"
configure_caddy_for_service "FileBrowser" "8085" "files"
write_readme "$FB_DIR" << MD
# FileBrowser
services/fmd.sh
+8
View File
@@ -44,10 +44,18 @@ services:
- ./data:/fmd/data
ports:
- "8084:8080"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
FMD_COMPOSE
cat > .env << FMD_ENV
FMD_ADMIN_PASSWORD=$FMD_PASS
CADDY_NET=$SITE_CADDY_NET
FMD_ENV
mkdir -p data
services/frigate-audio.sh
+8
View File
@@ -169,6 +169,7 @@ FN_FRIGATE__MQTT__PASSWORD=${MQTT_PASS}
FN_FRIGATE__SERVER=http://frigate:5000
FN_FRIGATE__PUBLIC_URL=${FRIGATE_PUBLIC_URL}
FN_ALERTS__NTFY__SERVER=${NTFY_SERVER}
CADDY_NET=$SITE_CADDY_NET
ENVEOF
chmod 600 "$DIR/.env"
log_success ".env written"
@@ -225,6 +226,8 @@ COMPOSEEOF
- "8554:8554"
- "8555:8555/tcp"
- "8555:8555/udp"
networks:
- caddy_net
healthcheck:
test: ["CMD", "curl", "-f", "http://127.0.0.1:5000/api/version"]
interval: 10s
@@ -257,6 +260,11 @@ COMPOSEEOF
condition: service_healthy
volumes:
- ./frigate-notify/config.yml:/app/config.yml:ro
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
COMPOSEEOF
log_success "docker-compose.yml written"
services/frigate-notify.sh
+7
View File
@@ -37,6 +37,13 @@ services:
restart: unless-stopped
volumes:
- ./config.yml:/app/config.yml:ro
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
FN_COMPOSE
# Smart defaults based on what's installed
services/frigate.sh
+8
View File
@@ -71,10 +71,18 @@ $DEVICE_BLOCK
- "8554:8554"
- "8555:8555/tcp"
- "8555:8555/udp"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
FRIGATE_COMPOSE
cat > .env << FRIGATE_ENV
FRIGATE_MEDIA=$FRIGATE_MEDIA
CADDY_NET=$SITE_CADDY_NET
FRIGATE_ENV
mkdir -p config
services/homeassistant.sh
+10 -1
View File
@@ -29,13 +29,16 @@ install_homeassistant() {
echo " HomeKit, mDNS/Zeroconf, some Zigbee/Z-Wave & Bluetooth)."
local HA_NETMODE=""
prompt_text " Choose networking mode [1]:" "1" HA_NETMODE
local HA_NET_LINES
local HA_NET_LINES HA_CADDY_NET_LINES
if [ "$HA_NETMODE" = "2" ]; then
HA_NET_LINES=" network_mode: host"
HA_CADDY_NET_LINES=""
echo " → Host networking selected (best device discovery)."
else
HA_NET_LINES=" ports:
- \"8123:8123\""
HA_CADDY_NET_LINES=" networks:
- caddy_net"
echo " → Bridge networking selected (port 8123 published)."
fi
@@ -55,6 +58,12 @@ services:
- ./config:/config
- /run/dbus:/run/dbus:ro
${HA_NET_LINES}
${HA_CADDY_NET_LINES}
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
HOMEASSISTANT_COMPOSE
mkdir -p config
services/immich.sh
+16
View File
@@ -137,6 +137,8 @@ services:
restart: always
healthcheck:
disable: false
networks:
- caddy_net
immich-machine-learning:
container_name: immich_machine_learning
@@ -170,6 +172,11 @@ services:
volumes:
model-cache:
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
IMMICH_COMPOSE
else
cat > docker-compose.yml << 'IMMICH_COMPOSE'
@@ -192,6 +199,8 @@ services:
restart: always
healthcheck:
disable: false
networks:
- caddy_net
immich-machine-learning:
container_name: immich_machine_learning
@@ -225,6 +234,11 @@ services:
volumes:
model-cache:
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
IMMICH_COMPOSE
fi
@@ -254,6 +268,7 @@ DB_PASSWORD=$DB_PASS
DB_USERNAME=postgres
DB_DATABASE_NAME=immich
TZ=$TZ_VAL
CADDY_NET=$SITE_CADDY_NET
IMMICH_ENV
else
cat > .env << IMMICH_ENV
@@ -271,6 +286,7 @@ DB_PASSWORD=$DB_PASS
DB_USERNAME=postgres
DB_DATABASE_NAME=immich
TZ=$TZ_VAL
CADDY_NET=$SITE_CADDY_NET
IMMICH_ENV
fi
services/jellyfin.sh
+8
View File
@@ -69,10 +69,18 @@ $HWACCEL_BLOCK
- "8096:8096"
- "1900:1900/udp"
- "7359:7359/udp"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
JELLYFIN_COMPOSE
cat > .env << JELLYFIN_ENV
MEDIA_PATH=$MEDIA_PATH
CADDY_NET=$SITE_CADDY_NET
JELLYFIN_ENV
mkdir -p config cache
services/js99er.sh
+7
View File
@@ -260,6 +260,13 @@ services:
ports:
- "${JS99ER_PORT}:80"
restart: unless-stopped
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
COMPOSE
log_success "Created js99er/docker-compose.yml"
services/lyrion.sh
+6
View File
@@ -56,10 +56,16 @@ services:
- \${MUSIC_PATH}:/music:ro
- ./playlists:/playlists:rw
- /etc/localtime:/etc/localtime:ro
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
LYRION_COMPOSE
cat > .env << LYRION_ENV
MUSIC_PATH=$MUSIC_PATH
CADDY_NET=$SITE_CADDY_NET
LYRION_ENV
mkdir -p config playlists
services/magicmirror.sh
+7
View File
@@ -63,6 +63,13 @@ services:
- ./css:/opt/magic_mirror/css
ports:
- "$MM_PORT:8080"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
MM_COMPOSE
mkdir -p config modules css
services/mealie.sh
+7
View File
@@ -50,6 +50,13 @@ services:
- ./data:/app/data
ports:
- "9925:9000"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
MEALIE_COMPOSE
mkdir -p data
services/meshcentral.sh
+8
View File
@@ -54,12 +54,20 @@ services:
ports:
- "4430:443"
- "4433:4433"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
MC_COMPOSE
cat > .env << MC_ENV
MC_HOSTNAME=$MC_HOSTNAME
MC_REVERSE_PROXY=false
MC_TLS_PORT=443
CADDY_NET=$SITE_CADDY_NET
MC_ENV
mkdir -p data files backups
services/ntfy.sh
+10
View File
@@ -35,10 +35,18 @@ services:
- ./config:/etc/ntfy
ports:
- "8090:80"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
NTFY_COMPOSE
cat > .env << NTFY_ENV
TZ=${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}
CADDY_NET=$SITE_CADDY_NET
NTFY_ENV
mkdir -p cache config
@@ -47,6 +55,8 @@ NTFY_ENV
echo ""
log_success "ntfy configured at $NTFY_DIR"
configure_caddy_for_service "ntfy" "8090" "ntfy"
write_readme "$NTFY_DIR" << MD
# ntfy
services/portainer.sh
+9
View File
@@ -33,6 +33,13 @@ services:
ports:
- "9000:9000"
- "9443:9443"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
PORTAINER_COMPOSE
mkdir -p data
@@ -41,6 +48,8 @@ PORTAINER_COMPOSE
echo ""
log_success "Portainer configured at $PORTAINER_DIR"
configure_caddy_for_service "Portainer" "9000" "portainer"
write_readme "$PORTAINER_DIR" << MD
# Portainer
services/traccar.sh
+7
View File
@@ -42,6 +42,13 @@ services:
- "8082:8082"
- "5000-5150:5000-5150"
- "5000-5150:5000-5150/udp"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
TRACCAR_COMPOSE
mkdir -p logs data config
services/uptimekuma.sh
+7
View File
@@ -32,6 +32,13 @@ services:
- /var/run/docker.sock:/var/run/docker.sock:ro
ports:
- "3001:3001"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
UPTIME_COMPOSE
mkdir -p data
services/watchtower.sh
+8
View File
@@ -71,6 +71,13 @@ services:
- WATCHTOWER_DEBUG=false
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- caddy_net
networks:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
WT_COMPOSE
# Create .env
@@ -99,6 +106,7 @@ MONITOR_ONLY=$MONITOR_ONLY
#
# Full list: https://containrrr.dev/shoutrrr/services/overview/
NOTIFICATION_URL=$NTFY_URL
CADDY_NET=$SITE_CADDY_NET
WT_ENV
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$WT_DIR" 2>/dev/null || true
services/wg-easy.sh
+8
View File
@@ -60,11 +60,19 @@ services:
ports:
- "51820:51820/udp"
- "51821:51821/tcp"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
WGEASY_COMPOSE
cat > .env << WGEASY_ENV
WG_HOST=$WG_HOST
WG_PASSWORD=$WG_PASSWORD
CADDY_NET=$SITE_CADDY_NET
WGEASY_ENV
mkdir -p config
services/wolf-pair.sh
+5
View File
@@ -239,6 +239,11 @@ services:
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
restart: unless-stopped
networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
COMPOSE
log_success "docker-compose.yml written"