Add homelab installer and services (allprox, authelia, lldap)

services/allprox/Caddyfile

@@ -0,0 +1,63 @@
+# allprox — Caddy reverse proxy
+#
+# Maps domains to local IPs and hosts an authenticated portal (web UI).
+# Edit the domain names below to match your DNS, and set the upstream
+# IP:port values in the installer's .env (APP1_UPSTREAM, APP2_UPSTREAM, ...).
+# Duplicate a "Proxied services" block to add more services.
+#
+# Authentication:
+#   * Today: basic_auth (a single admin account; hash set via PORTAL_AUTH_HASH).
+#   * Later: Authelia SSO — replace the basic_auth blocks with the forward_auth
+#     block shown below (see https://www.authelia.com/integration/proxies/caddy/).
+
+{
+	# For public domains with automatic HTTPS, set your ACME email here:
+	# email you@example.com
+}
+
+# ---------------------------------------------------------------------------
+# Web UI — authenticated portal (change the domain to your own)
+# ---------------------------------------------------------------------------
+portal.example.com {
+	# `tls internal` issues a self-signed cert for LAN use. Remove this line
+	# and set the ACME email above when exposing a real public domain.
+	tls internal
+
+	basic_auth {
+		admin {$PORTAL_AUTH_HASH}
+	}
+
+	# Authelia SSO (later): replace the basic_auth block above with:
+	#   forward_auth authelia:9091 {
+	#       uri /api/authz/forward-auth
+	#       copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+	#   }
+
+	root * /srv/portal
+	file_server
+}
+
+# ---------------------------------------------------------------------------
+# Authelia portal — the SSO login page (proxy to the authelia container).
+# With Authelia running, users are redirected here to sign in.
+# ---------------------------------------------------------------------------
+auth.example.com {
+	tls internal
+	reverse_proxy authelia:9091
+}
+
+# ---------------------------------------------------------------------------
+# Proxied services — copy a block per service. The local IP:port comes from
+# the {$APPx_UPSTREAM} variable in .env.
+# ---------------------------------------------------------------------------
+app1.example.com {
+	tls internal
+	# basic_auth { admin {$PORTAL_AUTH_HASH} }   # or the Authelia forward_auth block
+	reverse_proxy {$APP1_UPSTREAM}
+}
+
+app2.example.com {
+	tls internal
+	# basic_auth { admin {$PORTAL_AUTH_HASH} }
+	reverse_proxy {$APP2_UPSTREAM}
+}