Caddyfile

# Shared reverse proxy definition for Unsloth Studio
(proxy_studio) {
    reverse_proxy {$STUDIO_HOST}:{$STUDIO_PORT} {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
    }
}

# Trusted local network ranges (used by both the HTTPS and HTTP sites).
# Edit these ranges if your LAN uses different addressing.
(lan_ranges) {
    remote_ip 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12 127.0.0.0/8 ::1 fc00::/7
}

{
    admin off
    order authenticate first
    order trace before reverse_proxy
    order authorize before reverse_proxy

    # Disable the automatic HTTP->HTTPS redirect: it would be prepended to the
    # :80 server and shadow the LAN bypass below. Internet clients are still
    # redirected to HTTPS by the explicit @wan_clients route in the :80 site.
    auto_https disable_redirects

    # Security configuration with MFA
    security {
        # Local user store backing file
        local identity store localdb {
            realm local
            path /var/lib/caddy/users.json
        }

        # Email configuration for password reset
        messaging email provider localhost-smtp-server {
            address 127.0.0.1:1025
            protocol smtp
            passwordless
            sender root@localhost "Unsloth Studio MFA Portal"
            bcc admin@localhost
        }

        # Authentication portal with MFA
        authentication portal unsloth-portal {
            # JWT configuration for tokens
            crypto default token lifetime 3600
            crypto key sign-verify {env.JWT_SECRET}

            # Enable local identity store
            enable identity store localdb

            # Cookie settings
            cookie domain {$DOMAIN}

            # UI configuration
            ui {
                # Logo fetched from Unsloth instance at container startup
                static_asset "assets/images/logo.svg" "image/svg+xml" /var/lib/caddy/assets/logo.svg
                static_asset "assets/images/logo.png" "image/png" /var/lib/caddy/assets/logo.png
                logo url "/auth/assets/images/logo.svg"
                logo description "Unsloth Studio"

                links {
                    "Unsloth Studio" https://{$DOMAIN} target_blank icon "las la-flask"
                }
            }

            # User transformation
            transform user {
                match origin local
                action add role authp/user
                require mfa
                ui link "My Identity" /auth/whoami icon "las la-user"
            }
        }

        # Authorization policy
        authorization policy unsloth-policy {
            set auth url /auth
            crypto key verify {env.JWT_SECRET}
            allow roles authp/admin authp/user
        }
    }
}

# Main reverse proxy with same-domain authentication
{$DOMAIN} {
    @public_api {
        path /api /api/* /v1 /v1/* /openai /openai/* /chat/completions
    }

    # Clients from trusted local networks skip the login/MFA portal entirely.
    @trusted_lan {
        import lan_ranges
    }

    @untrusted {
        not {
            import lan_ranges
        }
    }

    route /auth* {
        authenticate with unsloth-portal
    }

    route @public_api {
        import proxy_studio
    }

    # Local LAN traffic: direct access, no authentication required
    route @trusted_lan {
        import proxy_studio
    }

    # Internet traffic: full password + MFA flow
    route @untrusted {
        authorize with unsloth-policy
        import proxy_studio
    }

    encode gzip zstd

    header {
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
    }
}

:80 {
    @trusted_lan {
        import lan_ranges
    }

    @wan_clients {
        not {
            import lan_ranges
        }
    }

    # Trusted LAN clients: plain HTTP, no TLS, no authentication
    route @trusted_lan {
        import proxy_studio
    }

    # Everyone else: force HTTPS (must be inside a route so it does not
    # run before the LAN check — Caddy orders redir before route)
    route @wan_clients {
        redir https://{$DOMAIN}{uri}
    }
}