orchard

mirror

Every site I host, in one repo, along with the Cloudflare Tunnel and Caddy that front them. It's all Go, Vite, and SQLite, and it runs on a desktop at home with nothing listening on an inbound port.

blogbuncaddycloudflare-tunneldockergogolanghomelabhtml-templatemonorepoself-hostedseosqlitestatic-sitetypstuptime-monitoringviteweb-analytics

 1# Locally-managed tunnel, so this file is the source of truth rather than a
 2# dashboard. Only credentials-file is secret, and it never leaves the volume.
 3
 4tunnel: CHANGEME_TUNNEL_ID
 5credentials-file: /etc/cloudflared/CHANGEME_TUNNEL_ID.json
 6
 7# One rule per hostname, all terminating at Caddy, which owns the per-site
 8# routing. The catch-all at the end is required by cloudflared.
 9ingress:
10  - hostname: isaacbythewood.com
11    service: http://caddy:80
12  - hostname: www.isaacbythewood.com
13    service: http://caddy:80
14  - hostname: blog.bythewood.me
15    service: http://caddy:80
16  - hostname: analytics.bythewood.me
17    service: http://caddy:80
18  - hostname: auth.bythewood.me
19    service: http://caddy:80
20  - hostname: status.bythewood.me
21    service: http://caddy:80
22  - hostname: logging.bythewood.me
23    service: http://caddy:80
24  - hostname: ntfy.bythewood.me
25    service: http://caddy:80
26  - hostname: repos.bythewood.me
27    service: http://caddy:80
28  - hostname: dash.bythewood.me
29    service: http://caddy:80
30  - hostname: search.bythewood.me
31    service: http://caddy:80
32  - hostname: chat.bythewood.me
33    service: http://caddy:80
34  - hostname: llm.bythewood.me
35    service: http://caddy:80
36
37  # The apex has never served a site. Caddy owns the redirect to the portfolio.
38  - hostname: bythewood.me
39    service: http://caddy:80
40  - hostname: www.bythewood.me
41    service: http://caddy:80
42
43  - service: http_status:404
44
45# Lets the origin be probed from inside the bridge, which separates "my tunnel
46# dropped" from "Cloudflare or DNS is wrong".
47metrics: 0.0.0.0:2000