--- title: "Caddy & DNS Reference" type: reference tags: - mesh aliases: [] related: - [[services]] - [[ip-allocation]] - [[lxc-service-migration]] - [[expose-service-edge2]] - [[authentik]] updated: 2026-07-13 --- # Caddy & DNS Reference > Migrated off Contabo → edge2 on 2026-06-19. ## edge2 Caddy (front door) **Config:** `/etc/caddy/Caddyfile` on edge2 (`ssh edge2`; `root@` is stale) **Global options:** `email admin@echo6.co`, `admin off` (no live reload — must `systemctl restart caddy`) ### Current Site Blocks | Domain | Backend | Service | |--------|---------|---------| | auth.echo6.co | 100.64.0.36:9000 (Tailscale, CT 105) | [[authentik]] SSO | | forge.echo6.co | 100.64.0.34:3001 (Tailscale, CT 103) | Forgejo Git | | mail.echo6.co | — | Mailcow — moved to **edge1** (separate mail-only host, 10.10.10.2:8453 via edge1's own Caddy); not on edge2 | | vpn.echo6.co | 100.64.0.38:8084 (Tailscale, CT 107) | Headscale | | vpn.echo6.co/admin* | 100.64.0.38:3100 (Tailscale, CT 107) | Headplane | | autodiscover.echo6.co | — | Mailcow autodiscover — moved to **edge1** (10.10.10.2:8453); not on edge2 | | autoconfig.echo6.co | — | Mailcow autoconfig — moved to **edge1** (10.10.10.2:8453); not on edge2 | | vault.echo6.co | 100.64.0.33:8086 (Tailscale, CT 102) | vaultwarden | | proxmox.echo6.co | https://100.64.0.6:8006 (via Tailscale) | Proxmox VE (data node) — unchanged | | wt.echo6.co | — | ~~WATCHTOWER ops dashboard~~ — **decommissioned 2026-06-16** (was 100.64.0.1, now dead) | | matrix.echo6.co | 100.64.0.37:8008 + 100.64.0.37:8085 (Tailscale, CT 106) | Matrix [[synapse]] + MAS (login/logout/refresh/auth_metadata → MAS:8085, _matrix/* → [[synapse]]:8008, default → MAS:8085) | | element.echo6.co | 100.64.0.37:8088 (Tailscale, CT 106) | Element Web client | | notes.echo6.co | 100.64.0.35:5984 + 100.64.0.35:5985 (Tailscale, CT 104) | LiveSync (CouchDB + provisioner, forward auth on /_provision*, CORS for Obsidian) | | tak.echo6.co | — | ~~TAK Server admin + SIGIL console~~ — **decommissioned 2026-06-16** (was 100.64.0.1, now dead) | ### Commands ```bash ssh edge2 caddy validate --config /etc/caddy/Caddyfile systemctl restart caddy # admin off, so reload won't work journalctl -u caddy -f ``` --- ## Utility Caddy (Home) **Location:** CT 101 on utility Proxmox (192.168.1.101) **Tailscale IP:** 100.64.0.8 **Config:** `/etc/caddy/Caddyfile` inside CT 101 **SSL Certs:** `/etc/caddy/certs/` (managed by acme.sh) **Port forward:** Router 80/443 → 192.168.1.101 ### Current Site Blocks | Domain | Backend | Pattern | Service | |--------|---------|---------|---------| | mesh.echo6.co | 192.168.1.100:8080 | Local IP | meshmonitor ([[authentik]] forward auth) | | echo6.co | 100.64.0.15:8080 | Tailscale | Echo6 Search ([[searxng]]) + Matrix well-known | | search.echo6.co | — | — | 301 redirect to echo6.co | | nas.echo6.co | 100.64.0.21:80 | Tailscale | OpenMediaVault (pi-nas) | | immich.echo6.co | 192.168.1.182:2283 | Local IP | immich (has 2FA) | | nextcloud.echo6.co | 192.168.1.183:11000 | Local IP | nextcloud AIO (SSO via Authentik) | | jellyfin.echo6.co | 100.64.0.18:8096 | Tailscale | Jellyfin media server (SSO via Authentik) | | requests.echo6.co | 100.64.0.18:5055 | Tailscale | Jellyseer request management (SSO via Authentik) | | stream.echo6.co | 192.168.1.170:80 | Local IP | peertube video streaming (SSO via Authentik) | | ai.echo6.co | 100.64.0.14:8080 | Tailscale | Open WebUI (SSO via Authentik) | | files.echo6.co | 100.64.0.24:8888 | Tailscale | [[recon]] PDF library (Authentik forward auth) | | recon.echo6.co | 100.64.0.24:8420 | Tailscale | [[recon]] dashboard + API | | lidarr.echo6.co | 100.64.0.18:8686 | Tailscale | lidarr music automation (Authentik forward auth) | | navidrome.echo6.co | 100.64.0.18:4533 | Tailscale | navidrome music server (Authentik forward auth, /rest/* exempt for Subsonic API) | | vpn.idahomesh.com | 192.168.1.106:8080 | Local IP | IdahoMesh Headscale VPN coordination | ### Commands ```bash ssh root@192.168.1.241 'pct exec 101 -- cat /etc/caddy/Caddyfile' ssh root@192.168.1.241 'pct exec 101 -- systemctl reload caddy' ssh root@192.168.1.241 'pct exec 101 -- journalctl -u caddy -f' ``` --- ## dnsmasq (Tailscale Split DNS) — HISTORICAL / OBSOLETE > **Not in use.** Tailnet split-DNS for echo6.co was retired: echo6.co now resolves via public GoDaddy [[dns]], not internal dnsmasq (see [[services]]). This section documents the OLD setup that ran on the original Contabo VPS (100.64.0.1) before its [[2026-06-19]] rebuild into edge1 (mail-only). That host and its 100.64.0.1 tailnet identity are dead — do not repoint these records to edge1 or edge2; kept below for historical reference only. **Config:** `/etc/dnsmasq.d/tailscale-dns.conf` on Contabo (dead host, pre-2026-06-19) **Listens on:** 100.64.0.1:53 (dead) ### Current Records | Domain | Tailscale IP | Service | |--------|-------------|---------| | auth.echo6.co | 100.64.0.1 | Authentik | | forge.echo6.co | 100.64.0.1 | Forgejo | | mail.echo6.co | 100.64.0.1 | Mailcow | | vpn.echo6.co | 100.64.0.1 | Headscale | | vault.echo6.co | 100.64.0.1 | Vaultwarden | | proxmox.echo6.co | 100.64.0.1 | Proxmox VE (via Caddy) | | stream.echo6.co | 100.64.0.8 | PeerTube (via Utility Caddy) | | notes.echo6.co | 100.64.0.1 | LiveSync CouchDB + provisioner (via Contabo Caddy) | | tak.echo6.co | 100.64.0.1 | TAK Server + SIGIL (via Contabo Caddy) | | jellyfin.echo6.co | 100.64.0.8 | Jellyfin (via utility Caddy) | | requests.echo6.co | 100.64.0.8 | Jellyseer (via utility Caddy) | | wt.echo6.co | 100.64.0.1 | WATCHTOWER ops dashboard | | ai.echo6.co | 100.64.0.8 | Open WebUI (via utility Caddy) | | matrix.echo6.co | 100.64.0.1 | Matrix [[synapse]] (via Contabo Caddy) | | element.echo6.co | 100.64.0.1 | Element Web (via Contabo Caddy) | | echo6.co | 100.64.0.8 | Echo6 Search homepage (via utility Caddy) | | files.echo6.co | 100.64.0.8 | [[recon]] PDF library (via utility Caddy) | | recon.echo6.co | 100.64.0.8 | [[recon]] dashboard (via utility Caddy) | | lidarr.echo6.co | 100.64.0.8 | Lidarr music automation (via utility Caddy) | | navidrome.echo6.co | 100.64.0.8 | Navidrome music server (via utility Caddy) | ### Commands ```bash # HISTORICAL — host is dead, commands no longer work ssh root@100.64.0.1 nano /etc/dnsmasq.d/tailscale-dns.conf systemctl restart dnsmasq dig +short forge.echo6.co @100.64.0.1 # Test ``` --- ## GoDaddy DNS Records (echo6.co) ### edge2 Services → 184.174.35.153 | Subdomain | Service | |-----------|---------| | auth | Authentik SSO | | forge | Forgejo Git | | vpn | Headscale VPN | | vault | Vaultwarden | | matrix | Matrix Synapse | | element | Element Web | | notes | LiveSync (CouchDB + provisioner) | | proxmox | Proxmox VE (via Tailscale to data node) | ### edge1 Services (mail-only host) → 5.189.158.149 | Subdomain | Service | |-----------|---------| | mail | Mailcow Email | ### Decommissioned records (removed from GoDaddy, 2026-06-16) | Subdomain | Service | |-----------|---------| | wt | ~~WATCHTOWER ops dashboard~~ | | tak | ~~TAK Server + SIGIL~~ | ### Home Services → 199.6.36.163 | Subdomain | Service | |-----------|---------| | @ | Echo6 Search homepage ([[searxng]]) | | ai | Open WebUI | | stream | PeerTube | | jellyfin | Jellyfin | | mesh | MeshMonitor | | nas | OpenMediaVault (pi-nas) | | search | [[searxng]] (redirects to echo6.co) | | immich | Immich | | nextcloud | Nextcloud | | requests | Jellyseer | | files | RECON PDF library | | recon | RECON dashboard | | lidarr | Lidarr music automation | | navidrome | Navidrome music server | ### Email Records | Type | Name | Value | |------|------|-------| | MX | @ | mail.echo6.co | | CNAME | autoconfig | mail.echo6.co | | CNAME | autodiscover | mail.echo6.co | | TXT | @ | v=spf1 mx a:mail.echo6.co -all | | TXT | _dmarc | v=DMARC1; p=quarantine | | TXT | dkim._domainkey | (DKIM key) | --- ## Headscale Config **Location:** `/opt/headscale/` on edge2 (CT 107, managed via `headscale-stack.service` systemd reboot guard) **Data:** Named Docker volume `headscale_headscale-data` **Config:** `/opt/headscale/config.yaml` ```yaml dns: base_domain: echo6.mesh nameservers: global: - 1.1.1.1 oidc: issuer: "https://auth.echo6.co/application/o/headscale/" client_id: "headscale" ``` **Split [[dns]]:** Previously configured via dnsmasq on Contabo (pre-2026-06-19). Not verified on edge2/edge1 in this pass — flagged stale/unresolved; see `## dnsmasq (Tailscale Split DNS)` section below (also unverified). **Headplane:** Deployed at `vpn.echo6.co/admin` - OIDC via Authentik. First login gets Owner. --- ## Port Map (edge2) | Service | Container Port | Host Binding (Tailscale) | Public Domain | |---------|---------------|--------------|---------------| | Authentik | 9000 | 100.64.0.36:9000 (CT 105) | auth.echo6.co | | Forgejo | 3000 | 100.64.0.34:3001 (CT 103) | forge.echo6.co | | Forgejo SSH | 22 | edge2 iptables DNAT :2222 → 100.64.0.34:2222 (CT 103) | Direct (not proxied) | | Headscale | 8080 | 100.64.0.38:8084 (CT 107) | vpn.echo6.co | | Headplane | 3000 | 100.64.0.38:3100 (CT 107) | vpn.echo6.co/admin | | Vaultwarden | 80 | 100.64.0.33:8086 (CT 102) | vault.echo6.co | | Vaultwarden WS | 3012 | 100.64.0.33:3012 (CT 102) | vault.echo6.co/notifications/hub | | ~~WATCHTOWER~~ | 8084 | — | ~~wt.echo6.co~~ — decommissioned 2026-06-16 | | Matrix Synapse | 8008 | 100.64.0.37:8008 (CT 106) | matrix.echo6.co (/_matrix/*, /_synapse/*) | | Matrix MAS | 8080 | 100.64.0.37:8085 (CT 106) | matrix.echo6.co (login/logout/refresh/auth_metadata, default) | | Element Web | 80 | 100.64.0.37:8088 (CT 106) | element.echo6.co | | LiveSync CouchDB | 5984 | 100.64.0.35:5984 (CT 104) | notes.echo6.co | | LiveSync Provisioner | 8080 | 100.64.0.35:5985 (CT 104) | notes.echo6.co/_provision/* | | ~~TAK Server Admin~~ | 8446 | — | ~~tak.echo6.co~~ — decommissioned 2026-06-16 | | ~~SIGIL Console~~ | 8990 | — | ~~tak.echo6.co/sigil~~ — decommissioned 2026-06-16 | ## Port Map (edge1 — mail-only, separate host) | Service | Container Port | Host Binding | Public Domain | |---------|---------------|--------------|---------------| | Mailcow | 8453 | 10.10.10.2:8453 (CT 101, via edge1 host Caddy + DNAT) | mail.echo6.co, autodiscover.echo6.co, autoconfig.echo6.co | --- *Last updated: 2026-07-11 — Flip off Contabo completed: "Contabo Caddy" section → "edge2 Caddy" (front door for auth/forge/vpn/vault/matrix/element/notes/proxmox, CTs verified against [[ip-allocation]]/[[services]]); Mailcow + autodiscover/autoconfig moved to edge1 (separate mail-only host, not on edge2); WATCHTOWER + TAK/SIGIL marked decommissioned (dead 100.64.0.1 backends removed); Headscale config location + Port Map updated to edge2; `ssh root@100.64.0.1` → `ssh edge2`. dnsmasq split-DNS section marked HISTORICAL/OBSOLETE (echo6.co split-DNS retired, ran on the dead pre-2026-06-19 Contabo host, not repointed to edge1/edge2 per [[services]]); GoDaddy DNS Records section corrected — edge2 [[services]] (auth/forge/vpn/vault/matrix/element/notes/proxmox) → 184.174.35.153, mail → edge1 5.189.158.149 (unchanged public IP), wt/tak marked as removed records. Prior: 2026-04-13 — Audit sync: added MAS routing on matrix.echo6.co, lidarr/navidrome/vpn.idahomesh.com to utility Caddy, proxmox/tak to GoDaddy, removed ghost docs.echo6.co entries, added dnsmasq lidarr/navidrome*