added caddy provider support

terraform.tfvars

@@ -40,8 +40,44 @@ dns_records = [
   { zone = "oswaldtheotter.lan", name = "proxmox", type = "A",     value = "192.168.0.240" },
   { zone = "oswaldtheotter.lan", name = "nas",    type = "CNAME", value = "portanas.oswaldtheotter.lan" },
   { zone = "oswaldtheotter.lan", name = "s3", type = "CNAME", value="portanas.oswaldtheotter.lan"},
+  { zone = "oswaldtheotter.lan", name = "hass", type = "A", value="192.168.0.70"},
+  { zone = "oswaldtheotter.lan", name = "homeassistant", type = "CNAME", value="hass.oswaldtheotter.lan"},
+  { zone = "oswaldtheotter.lan", name = "bookstack", type = "A", value="192.168.0.5"},
 ]
 
+
+# ── Reverse proxy (Caddy) ───────────────────────────────────────────────────────
+# Managed on the caddy LXC (192.168.0.5). The admin API listens on loopback, so
+# reach it by tunneling SSH to the box as the ansible user. Clear caddy_host to
+# disable Caddy management entirely.
+
+caddy_host     = "http://localhost:2019"
+caddy_ssh_host = "[email protected]:22"
+# From: ssh-keyscan 192.168.0.5 — must be refreshed if the LXC is rebuilt.
+# Must be the ECDSA key: the provider's (old) Go SSH client prefers
+# ecdsa-sha2-nistp256 during negotiation and pins the exact key it receives.
+caddy_ssh_host_key = "192.168.0.5 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLjluBg9JCITeqG4NPad4VNTkAcZDY3y9FU9CP5BAuKIr3TDhTFYzuAdNnROCEhW1ddJI9ZFKI5y/3xqNTmkHbA="
+
+# Each proxy serves plain HTTP on :80 by default; set protocol = "https" to
+# serve it on :443 instead. Note: .lan hostnames can't get public certificates,
+# so HTTPS sites use Caddy's internal CA — trust its root cert on your devices
+# to avoid browser warnings.
+caddy_proxies = {
+  # dns = {
+  #   host      = "dns.oswaldtheotter.lan"
+  #   upstreams = ["192.168.0.2:5380"]
+  # }
+  # secure-example = {
+  #   host      = "secure.oswaldtheotter.lan"
+  #   upstreams = ["192.168.0.202:80"]
+  #   protocol  = "https"
+  # }
+  bookstack = {
+    host      = "bookstack.oswaldtheotter.lan"
+    upstreams = ["192.168.0.4:30214"]
+  }
+}
+
 # ── Node definitions ───────────────────────────────────────────────────────────
 
 nodes = {