# ==============================================================================
# 家庭公网 HTTPS 统一反向代理网关 (Mac mini: 10443 端口)
# 运行方式：macOS System LaunchDaemon (sudo brew services start caddy)
# 配置文件路径：/opt/homebrew/etc/Caddyfile (与本文件同步)
# 证书：/Users/ixvii0iv/homelab/stacks/gateway/certs/ (由 acme.sh 自动续签 *.home.961504.xyz)
# ==============================================================================
{
    auto_https disable_redirects
}

# 0. 家庭统一导航总入口 Sun-Panel (https://home.961504.xyz:10443)
home.961504.xyz:10443, nav.home.961504.xyz:10443 {
    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
    encode zstd gzip
    reverse_proxy 127.0.0.1:3002
}

# 1. 极空间 Z4 NAS (https://z4.home.961504.xyz:10443 或 https://nas.home.961504.xyz:10443)
nas.home.961504.xyz:10443, z4.home.961504.xyz:10443 {
    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
    encode zstd gzip
    reverse_proxy 192.168.31.185:5055
}

# 2. 路由器 Mihomo / Clash 面板 (已开启 HTTP Basic Auth 密码锁保护: ixvii0iv / Mac mini密码)
clash.home.961504.xyz:10443 {
    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
    encode zstd gzip
    basic_auth {
        ixvii0iv $2a$14$VaaNvgIjsCJFzXCpIxjcOerKUIdkN7GhVWAlGh3/ZZjBOADY9lg..
    }
    reverse_proxy 192.168.31.1:9999
}

# 3. 小米路由器管理后台 (https://router.home.961504.xyz:10443)
router.home.961504.xyz:10443 {
    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
    encode zstd gzip
    basic_auth {
        ixvii0iv $2a$14$VaaNvgIjsCJFzXCpIxjcOerKUIdkN7GhVWAlGh3/ZZjBOADY9lg..
    }
    reverse_proxy 192.168.31.1:80
}

# 4. Lucky 控制台 (https://lucky.home.961504.xyz:10443)
lucky.home.961504.xyz:10443 {
    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
    encode zstd gzip
    reverse_proxy 127.0.0.1:16601
}

# 5. AGY 24小时云端 Web 工作台 (https://agy.home.961504.xyz:10443)
agy.home.961504.xyz:10443 {
    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
    encode zstd gzip
    basic_auth {
        ixvii0iv $2a$14$VaaNvgIjsCJFzXCpIxjcOerKUIdkN7GhVWAlGh3/ZZjBOADY9lg..
    }
    reverse_proxy 127.0.0.1:7681
}

# 6. Vaultwarden 私人密码保险箱 (https://vw.home.961504.xyz:10443)
vw.home.961504.xyz:10443 {
    tls /Users/ixvii0iv/homelab/stacks/gateway/certs/fullchain.pem /Users/ixvii0iv/homelab/stacks/gateway/certs/privkey.pem
    encode zstd gzip
    reverse_proxy 127.0.0.1:8222 {
        header_up X-Real-IP {remote_host}
    }
}