From 36237da276c8a5041401dba769458ef581af3782 Mon Sep 17 00:00:00 2001
From: SauravDhakal <sauravdhakal121@gmail.com>
Date: Sun, 9 Aug 2026 13:05:59 +0545
Subject: [PATCH] fix: Caddy and woodpecker for new stuff

---
 README.md               | 50 +++++++++++++++++++++++++++++++++++++++++
 caddy/Caddyfile         | 24 ++++++++++++++++++++
 services/woodpecker.yml |  1 +
 3 files changed, 75 insertions(+)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..858349e
--- /dev/null
+++ b/README.md
@@ -0,0 +1,50 @@
+# Hetzner VPS Infrastructure
+
+This repository contains the configuration and orchestration files for my personal VPS hosted on Hetzner. The infrastructure is entirely containerized using Docker and Docker Compose, with Caddy acting as a dynamic reverse proxy.
+
+## 🏗 Architecture Overview
+
+- **Orchestration**: Docker Compose is used to manage all services. To keep things clean, the main `docker-compose.yml` imports individual service definitions from the `services/` directory using the `include` directive.
+- **Reverse Proxy**: Caddy routes all incoming HTTP/HTTPS traffic to the correct containers. We use a custom Caddy build that includes the Cloudflare DNS plugin. This allows Caddy to automatically provision SSL certificates via DNS challenges, even for services not exposed to the public internet.
+- **Security & Access Model**: Access to services is split into two distinct tiers:
+  - **Public Services**: (e.g., Gitea, Immich, public websites) Accessible from the open web.
+  - **Private/VPN Services**: (e.g., Portainer, Vaultwarden, Filebrowser) Within the `Caddyfile`, these are explicitly bound to a private VPN IP (Tailscale/Netbird, e.g., `100.81.85.182`). These services are completely hidden from the public internet and can only be accessed while connected to the VPN.
+
+## 📂 Directory Structure
+
+```text
+.
+├── docker-compose.yml  # Main entrypoint that includes all modular services
+├── services/           # Individual service compose configurations (*.yml)
+├── caddy/              # Custom Caddy Dockerfile and main Caddyfile configuration
+├── data/               # Persistent data storage for all running containers
+└── .env                # Environment variables and secrets (Cloudflare tokens, DB passwords, etc.)
+```
+
+## 🛠 Included Services
+
+The stack currently runs a variety of self-hosted tools:
+
+- **Infrastructure**: Caddy (Proxy), Portainer (Container UI), Uptime Kuma (Monitoring)
+- **Development**: Gitea (Git Server), Woodpecker (CI/CD Pipeline)
+- **Productivity**: Vaultwarden (Passwords), Memos (Notes), Docmost (Wiki), Actual (Budgeting)
+- **Media & Files**: Immich (Photos), Syncthing (File Sync), Filebrowser (Web File Manager)
+- **Automation**: n8n (Workflow Automation)
+
+## 🚀 Deployment
+
+1. Ensure Docker and Docker Compose are installed on the server.
+2. Clone this configuration repository to your VPS.
+3. Create a `.env` file in the root directory containing your necessary secrets:
+   ```env
+   CLOUDFLARE_API_TOKEN=your_token_here
+   # Add other required database passwords and variables here
+   ```
+4. Start up the entire stack:
+   ```bash
+   docker compose up -d
+   ```
+5. To view logs for a specific service (e.g., Gitea) to troubleshoot startup:
+   ```bash
+   docker compose logs --tail=100 -f gitea
+   ```
diff --git a/caddy/Caddyfile b/caddy/Caddyfile
index c37f9ea..66d66bb 100644
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -144,3 +144,27 @@ docs.sauravdhakal.com.np {
 #     bind 100.81.85.182
 #     reverse_proxy localhost:61208
 # }
+
+# -----------------------------------------------
+# NEPSE APP (Production - Public)
+# -----------------------------------------------
+nepse.sauravdhakal.com.np {
+    reverse_proxy localhost:4000
+}
+
+api.nepse.sauravdhakal.com.np {
+    reverse_proxy localhost:4001
+}
+
+# -----------------------------------------------
+# NEPSE APP (Staging - VPN Only)
+# -----------------------------------------------
+staging-nepse.sauravdhakal.com.np {
+    bind 100.81.85.182
+    reverse_proxy localhost:4100
+}
+
+api.staging-nepse.sauravdhakal.com.np {
+    bind 100.81.85.182
+    reverse_proxy localhost:4101
+}
diff --git a/services/woodpecker.yml b/services/woodpecker.yml
index 4def0f1..968e093 100644
--- a/services/woodpecker.yml
+++ b/services/woodpecker.yml
@@ -25,6 +25,7 @@ services:
     environment:
       - WOODPECKER_SERVER=woodpecker-server:9000
       - WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}
+      - WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /home/saurav/hetzner_self/data/woodpecker-agent:/etc/woodpecker