added jellyfin

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-18 15:03:27 +02:00
parent 7846372ee7
commit aaef0796a3
12 changed files with 627 additions and 33 deletions
@@ -0,0 +1,57 @@
+# Reverse proxy with Caddy
+
+Every service in this repo publishes a plain HTTP port on the host. Nothing
+in a service's compose file knows or cares about TLS, domains, or
+authentication — that is all handled here, in one place.
+
+This is deliberate: it means you can run any stack in this repo standalone,
+and add a proxy later without touching the compose file.
+
+## The basic pattern
+
+Caddy gets a certificate automatically. For most services, one block is the
+entire configuration:
+
+```caddyfile
+app.example.com {
+    reverse_proxy <host>:<port>
+}
+```
+
+Look up `<port>` in the [service table](../README.md).
+
+TODO: note where your Caddyfile lives and whether Caddy runs on the NAS or
+on the VPS.
+
+## Services that need more
+
+Most apps don't care what's in front of them. A few build absolute URLs or
+make security decisions based on the request, and those need to be told.
+
+**Nextcloud** is the main one — it needs all of:
+
+- `trusted_domains` — the public hostname, or it refuses the request
+- `overwrite.cli.url` — so generated links use the public URL
+- `overwriteprotocol=https` — or it builds `http://` links behind TLS and
+  breaks mixed content
+- `TRUSTED_PROXIES` — the proxy's IP, or every client appears to come from
+  the proxy and rate limiting misfires
+
+Milder cases:
+
+- **Gitea** — `ROOT_URL`, or clone URLs point at the wrong host
+- **Authentik** — knows its own external URL by configuration
+- **Jellyfin** — only if you serve it from a subpath rather than a subdomain
+
+TODO: your `header_up` defaults, and whether you set a shared snippet for
+`X-Forwarded-*`.
+
+## Large uploads
+
+TODO: Caddy's defaults are usually fine, but note any `request_body`
+`max_size` you set for Nextcloud/Immich, plus the matching app-side limit.
+
+## Related
+
+- [Cloudflare Tunnel](cloudflare-tunnel.md) — when you don't want to open a port
+- [Single sign-on with Authentik](authentik-sso.md)