initial scaffold

docs/Caddyfile.example

@@ -0,0 +1,30 @@
+# Add these blocks to the Caddyfile your Podman Caddy container already
+# loads (alongside the existing git.boglabob.com block for Forgejo).
+# Replace the node IPs with your actual k3s node IPs from `tofu output
+# node_ips` (10.20.30.0/24 by default).
+#
+# These IPs are on the private libvirt network the VMs live on (see
+# terraform/variables.tf's network_cidr), only directly routable from the
+# T630 itself — but since Caddy also runs on the T630 (Podman), it reaches
+# them the same way any other process on the host would: no extra network
+# config needed here.
+#
+# podinfo/hello sit behind Traefik's ServiceLB, which listens on port 80 of
+# every k3s node and routes by the Host header — so Caddy just needs to
+# forward the request (Host header included) to any node. Listing all three
+# gives you free load-balancing/failover across nodes.
+#
+# Deliberately NOT here: the Kubernetes Dashboard and the k3s API server.
+# Both grant cluster-admin-level control, and routing either through a
+# public-facing reverse proxy is the exact pattern behind real-world
+# cluster breaches (e.g. Tesla, 2018 — an exposed, unauthenticated
+# Dashboard). Both stay LAN-only / on-demand instead — see docs/SETUP.md
+# steps 12-13.
+
+podinfo.boglabob.com {
+	reverse_proxy http://10.20.30.11:80 http://10.20.30.12:80 http://10.20.30.13:80
+}
+
+hello.boglabob.com {
+	reverse_proxy http://10.20.30.11:80 http://10.20.30.12:80 http://10.20.30.13:80
+}