vps-server/services/caddy/Caddyfile

(forward_headers) {
        header {
                Permissions-Policy interest-cohort=()
                Strict-Transport-Security "max-age=31536000; includeSubdomains"
                X-XSS-Protection "1; mode=block"
                X-Content-Type-Options "nosniff"
                X-Robots-Tag noindex, nofollow
                Referrer-Policy "same-origin"
                Content-Security-Policy "frame-ancestors {$public_domain }} *.{$public_domain}"
                -Server
                Permissions-Policy "geolocation=(self {$public_domain }} *.{$public_domain}), microphone=()"
        }
}

auth.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

audiobookshelf.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

gitea.{$public_domain} {
        reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

headscale.{$public_domain} {
        reverse_proxy headscale:8080
        tls {$email}
        import forward_headers
}

immich.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

ldap.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

linkwarden.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

mealie.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

navidrome.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

ntfy.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

paperless.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

radicale.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

rss.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

pdf.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

superset.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

vaultwarden.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

vikunja.{$public_domain} {
	reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}

{$public_domain} {
        reverse_proxy {$main_server_ip} {
                transport http {
                        tls_insecure_skip_verify
                }
        }
        tls {$email}
        import forward_headers
}