llm-orchestrator/Caddyfile at main · bcdub/llm-orchestrator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
# Caddyfile for LLM Orchestrator
# Automatic HTTPS with Let's Encrypt

{$DOMAIN_NAME:localhost} {
    # Main chat interface
    handle / {
        reverse_proxy open-webui:8080
    }

    # AgentScope Studio
    handle /agents/* {
        reverse_proxy agentscope-runtime:8080
    }

    # n8n workflows
    handle /workflows/* {
        reverse_proxy n8n:5678
    }

    # Langfuse observability
    handle /observability/* {
        reverse_proxy langfuse:3000
    }

    # Supabase admin
    handle /admin/* {
        reverse_proxy supabase-studio:3000
    }

    # Neo4j browser
    handle /graph/* {
        reverse_proxy neo4j:7474
    }

    # Qdrant dashboard
    handle /vectors/* {
        reverse_proxy qdrant:6333
    }

    # SearXNG search
    handle /search/* {
        reverse_proxy searxng:8080
    }

    # API endpoints
    handle /api/* {
        reverse_proxy agentscope-runtime:8080
    }

    # Health check endpoint
    handle /health {
        respond "OK" 200
    }

    # Security headers
    header {
        # Enable HSTS
        Strict-Transport-Security max-age=31536000;
        # Prevent MIME sniffing
        X-Content-Type-Options nosniff
        # Prevent clickjacking
        X-Frame-Options DENY
        # XSS protection
        X-XSS-Protection "1; mode=block"
        # Referrer policy
        Referrer-Policy strict-origin-when-cross-origin
        # Content Security Policy
        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' ws: wss:;"
    }

    # Logging
    log {
        output file /var/log/caddy/access.log
        format json
    }

    # Rate limiting
    rate_limit {
        zone static {
            key {remote_host}
            events 100
            window 1m
        }
    }
}

# Admin interface (separate subdomain)
admin.{$DOMAIN_NAME:localhost} {
    # Supabase Studio
    handle /db/* {
        reverse_proxy supabase-studio:3000
    }

    # Neo4j Browser
    handle /graph/* {
        reverse_proxy neo4j:7474
    }

    # Qdrant Dashboard
    handle /vectors/* {
        reverse_proxy qdrant:6333
    }

    # n8n Workflows
    handle /workflows/* {
        reverse_proxy n8n:5678
    }

    # Langfuse Observability
    handle /observability/* {
        reverse_proxy langfuse:3000
    }

    # Default to Supabase Studio
    handle {
        reverse_proxy supabase-studio:3000
    }

    # Basic auth for admin interface
    basicauth {
        admin {$ADMIN_PASSWORD_HASH}
    }
}

# API subdomain
api.{$DOMAIN_NAME:localhost} {
    # AgentScope API
    handle /v1/* {
        reverse_proxy agentscope-runtime:8080
    }

    # Ollama API
    handle /ollama/* {
        reverse_proxy ollama:11434
    }

    # Direct model access
    handle /models/* {
        reverse_proxy ollama:11434
    }

    # Health checks
    handle /health {
        respond "API OK" 200
    }

    # CORS headers for API
    header {
        Access-Control-Allow-Origin *
        Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
        Access-Control-Allow-Headers "Content-Type, Authorization"
    }

    # Handle preflight requests
    @options method OPTIONS
    handle @options {
        respond "" 204
    }
}