auth.thesatelliteoflove.com {
    reverse_proxy authentik-server-1:9000
}

{{ subdomains.pocketid }} {
    reverse_proxy pocket-id:1411
}

paper.thesatelliteoflove.com {
    reverse_proxy paperlessngx-webserver-1:8000
}

cal.thesatelliteoflove.com {
    redir /.well-known/caldav /dav.php 302
    redir /.well-known/carddav /dav.php 302
    reverse_proxy baikal-baikal-1:80
}

{{ subdomains.books }} {
    reverse_proxy kavita:5000
}

audio.thesatelliteoflove.com {
    reverse_proxy audiobookshelf-audiobookshelf-1:80
}

loclog.thesatelliteoflove.com {
    reverse_proxy dawarich_app:3000
}

watcher.thesatelliteoflove.com {
    reverse_proxy changedetection:5000
}

snippets.thesatelliteoflove.com {
    reverse_proxy bytestash:5000
}

git.thesatelliteoflove.com {
    reverse_proxy gitea:3000
}

thesatelliteoflove.com {
    # WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account
    # domain is this apex) and Tailscale, which finds the tailnet's login
    # provider through the OpenID issuer link.
    # Answered for every query: Tailscale's lookup doesn't always send
    # resource=acct:phil@..., and phil is the only account here anyway.
    @webfinger_phil path /.well-known/webfinger
    route {
        header @webfinger_phil Content-Type application/jrd+json
        header @webfinger_phil Access-Control-Allow-Origin *
        respond @webfinger_phil `{"subject":"acct:phil@{{ primary_domain }}","aliases":["https://{{ subdomains.social }}/users/phil","https://{{ subdomains.social }}/@phil"],"links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://{{ subdomains.pocketid }}"},{"rel":"http://webfinger.net/rel/profile-page","type":"text/html","href":"https://{{ subdomains.social }}/@phil"},{"rel":"self","type":"application/activity+json","href":"https://{{ subdomains.social }}/users/phil"}]}` 200
        # Other fediverse discovery goes to GoToSocial.
        redir /.well-known/host-meta* https://{{ subdomains.social }}{uri} 301
        redir /.well-known/nodeinfo https://{{ subdomains.social }}{uri} 301
    }
    root * /srv/tsol
    file_server
}

bookmarks.thesatelliteoflove.com {
    reverse_proxy hoarder-web-1:3000
}

social.thesatelliteoflove.com {
    reverse_proxy gotosocial:8080
}

models.thesatelliteoflove.com {
    reverse_proxy manyfold-app-1:3214
}


gotify.thesatelliteoflove.com {
    reverse_proxy gotify:80
}

gotify-assistant.thesatelliteoflove.com {
    reverse_proxy igotify-assistant:8080
}

pdg.thesatelliteoflove.com {
    root * /srv/pdg
    try_files {path} {path}.html {path}/ =404
    file_server
    encode gzip
 
    handle_errors {
        rewrite * /{err.status_code}.html
        file_server
    }
}

gondulf.thesatelliteoflove.com {
    reverse_proxy gondulf:8000
  }

starpunk.thesatelliteoflove.com {
    reverse_proxy starpunk:8000
  }

repair.nerder.land {
    root * /srv/repair
    file_server
}

nerder.land {
    root * /srv/nerderland
    file_server
}

forms.nerder.land {
    reverse_proxy heyform-heyform-1:8000
}

listmonk.nerder.land {
    reverse_proxy listmonk:9000
}

repaircafe.nerder.land {
    redir /volunteer-signup https://listmonk.nerder.land/subscription/form 301
}

gokapi.thesatelliteoflove.com {
    reverse_proxy gokapi:53842
}