firstfinger/caddy repository overview

# Stage 1: Build Caddy with plugins
FROM caddy:builder AS builder

# Build custom Caddy with specified plugins
RUN xcaddy build \
    --with github.com/caddy-dns/cloudflare \
    --with github.com/mholt/caddy-l4 \
    --with github.com/caddy-dns/duckdns

# Stage 2: Create a small image
FROM caddy:latest

# Copy the custom Caddy binary from the builder
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

HEALTHCHECK NONE

services:
  caddy:
    image: firstfinger/caddy:latest
    container_name: caddy
    network_mode: host
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./data:/data
    environment:
      - DUCKDNS_API_TOKEN=${DUCKDNS_API_TOKEN}
      - CLOUDFLARE_API_TOKEN=${CF_API_TOKEN}
      - EMAIL=${EMAIL}
    restart: always

{
	email {env.EMAIL}
	acme_ca https://acme-v02.api.letsencrypt.org/directory
	# acme_ca https://acme-staging-v02.api.letsencrypt.org/directory # Staging environment

	# Enable HTTP/3 (QUIC) support
	servers {
		protocols h1 h2 h3
	}

	admin off
	storage file_system {
		root /data
	}
	
	log {
		level DEBUG
	}
}

www.firstfinger.io {
	tls {
		dns cloudflare {env.CLOUDFLARE_API_TOKEN}
		resolvers 1.1.1.1
	}
	header Strict-Transport-Security "max-age=31536000;"
	redir https://firstfinger.io{uri} permanent
}

firstfinger.io {
	tls {
		dns cloudflare {env.CLOUDFLARE_API_TOKEN}
		resolvers 1.1.1.1
	}
	reverse_proxy firstfinger:2368
	header {
		Strict-Transport-Security "max-age=31536000;"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
	}
}