virtuallab.knf.vu.lt/Caddyfile at main · kaunofakultetas/virtuallab.knf.vu.lt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
########################################################
##################### NON VU BLOCKER ###################
########################################################
(allow_only_vu) {
    # Local VU networks
    remote_ip 172.16.0.1/16
    remote_ip 192.168.0.1/16
    remote_ip 10.0.0.1/8

    # VU VPN networks
    remote_ip 193.219.95.0/24
    remote_ip 10.198.0.0/16
    remote_ip 158.129.162.0/24

    # VU KNF external network
    remote_ip 158.129.172.0/24
}
# Traffic blocking function/subroutine
(geo_block_non_vu) {
    @block_non_vu {
        not {
            import allow_only_vu
        }
    }

    header @block_non_vu Content-Type "text/html; charset=utf-8"
    respond @block_non_vu `<!DOCTYPE html>
    <html>
        <body>
            <p>Sistema nepasiekiama iš jūsų IP adreso. Prašome susidiegti VU VPN.</p>
            <p>Daugiau informacijos: <a href="https://www.vu.lt/it/paslaugos/irenginiai-programos-tinklai-ir-spausdinimas/vu-vpn">VU VPN</a></p>
            <p>Jūsų IP adresas: {remote_host}</p>
            <hr>
            <p>Or if you are a hacker you can review our blueprints for our IT infrastructure here:<br>
            <a href="https://www.youtube.com/watch?v=dQw4w9WgXcQ">IT Infrastructure Blueprints</a></p>
            <hr>
        </body>
    </html>` 403
}
########################################################
########################################################
########################################################

(virtual_lab_routes) {
    route {
        import geo_block_non_vu

        handle_path /api/* {
            reverse_proxy backend:3000 {
                header_up X-Forwarded-For {remote_host}
            }
        }

        handle_path /guac/* {
            reverse_proxy 10.10.10.50:8080 {
                header_up X-Forwarded-For {remote_host}
            }
        }

        # Docusaurus builds with baseUrl /docs/ and is copied to /srv/docs.
        @docs path /docs /docs/*
        handle @docs {
            root * /srv
            try_files {path} {path}/ /docs/404.html
            file_server
        }

        handle {
            root * /srv/frontend
            try_files {path} /index.html
            file_server
        }
    }
}

http://{$CADDY_IP_HTTP_HOST:disabled.invalid} {
    import virtual_lab_routes
}

:80 {
    reverse_proxy notfound404-vite:80 {
        header_up X-Forwarded-For {remote_host}
    }
}

virtuallab.knf.vu.lt {
    tls admin@knf.vu.lt

    import virtual_lab_routes

    log {
        output file /var/log/caddy/access.log
        format json
    }
}

virtuallab.knf.vu.lt:8888 {
    tls admin@knf.vu.lt

    route {
        import geo_block_non_vu

        forward_auth backend:3000 {
            uri /instances/proxy-auth
            copy_headers X-Target-Host X-Target-Proto
        }

        reverse_proxy 10.10.10.50:9443 {
            header_up X-Forwarded-For {remote_host}
        }
    }

    log {
        output file /var/log/caddy/access.log
        format json
    }
}