Skip to content

Commit 56a8cdb

Browse files
NitestackNitestack
committed
feat(cloudflare-tunnel): switch to Cloudflare Tunnel
1 parent 755f152 commit 56a8cdb

File tree

15 files changed

+419
-403
lines changed

15 files changed

+419
-403
lines changed

‎README.md‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@ _This [Ansible](https://ansible.com) configuration automates the setup of a Home
3737
- **Beszel**: Server Monitoring
3838
- **Caddy**: Reverse Proxy & TLS
3939
- **Calibre Web Automated**: eBook Manager
40-
- **Cloudflare DDNS**: Dynamic DNS Updater
4140
- **Ente Auth**: Two-factor Authenticator
4241
- **FreshRSS**: Feed Aggregator
4342
- **Ghostfolio**: Wealth Manager
@@ -56,8 +55,9 @@ _This [Ansible](https://ansible.com) configuration automates the setup of a Home
5655

5756
1. **Raspberry Pi OS Lite (64-bit)**: Ensure your Raspberry Pi is running the latest version.
5857
2. **Ansible**: Install Ansible on your local machine.
59-
3. **Cloudflare-managed domain**: Required for dynamic DNS updates and subdomain routing.
60-
4. **Ethernet connection**: Use a wired connection for your Raspberry Pi for stable performance.
58+
3. **Cloudflare Account**: Required for dynamic DNS updates and subdomain routing. Sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up).
59+
4. **Cloudflare Zero Trust**: Required for secure access via Cloudflare Tunnel. Create a [Zero Trust Organization](https://developers.cloudflare.com/cloudflare-one/setup/#create-a-zero-trust-organization).
60+
5. **Ethernet connection**: Use a wired connection for your Raspberry Pi for stable performance.
6161

6262
> [!Important]
6363
> When flashing your SD card, enable SSH and select the `Use password authentication` option.
@@ -125,16 +125,8 @@ ansible-vault encrypt group_vars/all/vault.yml # encrypt file
125125
To ensure remote access and proper functionality, configure the following port forwarding rules on your router. The playbook will automatically configure the server's firewall (UFW) based on these variables.
126126

127127
```plaintext
128-
# Caddy (handling all websites and APIs)
129-
public:80/tcp -> local:80/tcp
130-
public:443/tcp -> local:443/tcp
131-
public:443/udp -> local:443/udp
132-
133128
# WireGuard
134129
public:51820/udp -> local:51820/udp
135-
136-
# SSH (optional, if you want to access the Pi with a URL)
137-
public:22/tcp -> local:22/tcp
138130
```
139131

140132
## 🛡️ Security

‎deploy.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@
1414
tags: docker
1515
- role: caddy
1616
tags: caddy
17-
- role: cloudflare_ddns
18-
tags: cloudflare_ddns
17+
- role: cloudflare_tunnel
18+
tags: cloudflare_tunnel
1919

2020
- role: wg_easy
2121
tags: wg_easy

‎group_vars/all/main.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,7 @@ data_base_dir: "/mnt/data"
77
backup_base_dir: "/mnt/backup"
88
service_base_dir: "~/services"
99
allowed_ports:
10-
- 22 # SSH
1110
- 53 # DNS
12-
- 80 # Caddy HTTP
13-
- 443 # Caddy HTTPS
1411
- 51820 # VPN
1512

1613
# ── Service Configuration ─────────────────────────────────────────────

‎group_vars/all/vault.yml‎

Lines changed: 311 additions & 305 deletions
Large diffs are not rendered by default.

‎inventory.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
[raspberrypi]
2-
npham.de ansible_user=nhan ansible_python_interpreter=auto_silent
2+
raspberrypi.local ansible_user=nhan ansible_python_interpreter=auto_silent

‎roles/caddy/templates/Caddyfile.j2‎

Lines changed: 76 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,85 @@
11
{% for name, service in services.items() %}
2-
{% if service.enabled %}
3-
{{ service.domain }} {
4-
{% if name == "adventure_log" %}
5-
@frontend {
6-
not path /media* /admin* /static* /accounts*
7-
}
8-
reverse_proxy @frontend {{ service.container_names.frontend }}:{{ service.ports.frontend }}
9-
reverse_proxy {{ service.container_names.backend }}:{{ service.ports.backend }}
10-
{% elif name == "beszel" %}
11-
request_body {
12-
max_size 10MB
13-
}
14-
reverse_proxy {{ service.container_name }}:{{ service.port }} {
15-
transport http {
16-
read_timeout 360s
17-
}
18-
}
19-
{% elif name == "n8n" %}
20-
reverse_proxy {{ service.container_name }}:{{ service.port }} {
21-
flush_interval -1
22-
}
23-
{% elif name == "nextcloud" %}
24-
header Strict-Transport-Security max-age=31536000;
2+
{% if service.enabled and service.domain == domain %}
3+
{{ domain }} {
254
reverse_proxy {{ service.container_name }}:{{ service.port }}
26-
{% elif name == "nextcloud_aio" %}
27-
reverse_proxy {{ service.container_name }}:{{ service.port }} {
28-
transport http {
29-
tls_insecure_skip_verify
5+
}
6+
{% endif %}
7+
{% endfor %}
8+
9+
*.{{ domain }} {
10+
tls internal
11+
12+
{% for name, service in services.items() %}
13+
{% if service.enabled and service.domain == domain %}
14+
@www host www.{{ domain }}
15+
16+
redir @www {scheme}://{{ domain }}/{uri} permanent
17+
18+
{% endif %}
19+
{% endfor %}
20+
21+
{% for name, service in services.items() %}
22+
{% if service.enabled and service.domain != domain %}
23+
@{{ name }} host {{ service.domain }}
24+
25+
handle @{{ name }} {
26+
{% if name == "adventure_log" %}
27+
@frontend {
28+
not path /media* /admin* /static* /accounts*
3029
}
31-
}
32-
{% elif name == "vaultwarden" %}
33-
encode zstd gzip
34-
reverse_proxy {{ service.container_name }}:{{ service.port }} {
35-
header_up X-Real-IP {remote_host}
36-
}
37-
{% elif name == "wger" %}
38-
encode
30+
reverse_proxy @frontend {{ service.container_names.frontend }}:{{ service.ports.frontend }}
31+
reverse_proxy {{ service.container_names.backend }}:{{ service.ports.backend }}
32+
{% elif name == "beszel" %}
33+
request_body {
34+
max_size 10MB
35+
}
36+
reverse_proxy {{ service.container_name }}:{{ service.port }} {
37+
transport http {
38+
read_timeout 360s
39+
}
40+
}
41+
{% elif name == "n8n" %}
42+
reverse_proxy {{ service.container_name }}:{{ service.port }} {
43+
flush_interval -1
44+
}
45+
{% elif name == "nextcloud" %}
46+
header Strict-Transport-Security max-age=31536000;
47+
reverse_proxy {{ service.container_name }}:{{ service.port }}
48+
{% elif name == "nextcloud_aio" %}
49+
reverse_proxy {{ service.container_name }}:{{ service.port }} {
50+
transport http {
51+
tls_insecure_skip_verify
52+
}
53+
}
54+
{% elif name == "vaultwarden" %}
55+
encode zstd gzip
56+
reverse_proxy {{ service.container_name }}:{{ service.port }} {
57+
header_up X-Real-IP {remote_host}
58+
}
59+
{% elif name == "wger" %}
60+
encode
3961

40-
reverse_proxy {{ service.container_name }}:{{ service.port }} {
41-
header_up X-Real-IP {remote_host}
42-
}
62+
reverse_proxy {{ service.container_name }}:{{ service.port }} {
63+
header_up X-Real-IP {remote_host}
64+
}
4365

44-
handle /static/* {
45-
root * /srv/wger
46-
file_server
66+
handle /static/* {
67+
root * /srv/wger
68+
file_server
69+
}
70+
71+
handle /media/* {
72+
root * /srv/wger
73+
file_server
74+
}
75+
{% else %}
76+
reverse_proxy {{ service.container_name }}:{{ service.port }}
77+
{% endif %}
4778
}
79+
{% endif %}
80+
{% endfor %}
4881

49-
handle /media/* {
50-
root * /srv/wger
51-
file_server
82+
handle {
83+
redir https://{{ domain }}{uri}
5284
}
53-
{% else %}
54-
reverse_proxy {{ service.container_name }}:{{ service.port }}
55-
{% endif %}
5685
}
57-
{% endif %}
58-
{% endfor %}

‎roles/caddy/templates/compose.yml.j2‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ services:
66
ports:
77
- "80:80"
88
- "443:443"
9-
- "443:443/udp"
109
networks:
1110
- caddy
1211
volumes:

‎roles/cloudflare_ddns/defaults/main.yml‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎roles/cloudflare_ddns/tasks/main.yml‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎roles/cloudflare_ddns/templates/compose.yml.j2‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

0 commit comments

Comments
 (0)