Monitoring primarily

2026-05-10 11:30:43 +03:00
parent 0e54760e34
commit af744e819c
20 changed files with 1269 additions and 43 deletions
@@ -207,6 +207,58 @@ in
          '';
        };

+        # ------------------------------------------------------------------
+        # Uptime Kuma — two_factor, admins only (enforced by authelia policy)
+        # ------------------------------------------------------------------
+        "uptime.${domain}" = {
+          extraConfig = ''
+            ${autheliaForwardAuth}
+            reverse_proxy localhost:3001
+          '';
+        };
+        "http://uptime.${domain}" = {
+          extraConfig = ''
+            ${autheliaForwardAuth}
+            ${cfProxy 3001}
+          '';
+        };
+
+        # ------------------------------------------------------------------
+        # Ntfy — no forward_auth; ntfy has its own token/password auth so the
+        # mobile app can connect without Authelia SSO complications.
+        # ------------------------------------------------------------------
+        "ntfy.${domain}" = {
+          extraConfig = ''
+            reverse_proxy localhost:2586
+          '';
+        };
+        "http://ntfy.${domain}" = {
+          extraConfig = cfProxy 2586;
+        };
+
+        # ------------------------------------------------------------------
+        # Grafana — two_factor, admins only (enforced by authelia policy).
+        # After Authelia verifies the user, Caddy maps the Remote-User header
+        # to X-WEBAUTH-USER so Grafana's proxy auth auto-signs the user in.
+        # ------------------------------------------------------------------
+        "grafana.${domain}" = {
+          extraConfig = ''
+            ${autheliaForwardAuth}
+            reverse_proxy localhost:3002 {
+              header_up X-WEBAUTH-USER {http.request.header.Remote-User}
+            }
+          '';
+        };
+        "http://grafana.${domain}" = {
+          extraConfig = ''
+            ${autheliaForwardAuth}
+            reverse_proxy localhost:3002 {
+              header_up X-Forwarded-Proto https
+              header_up X-WEBAUTH-USER {http.request.header.Remote-User}
+            }
+          '';
+        };
+
      };
    };