# The vault's SilverBullet, for the operator's Caddy on docker.garrett-hall.com
# (/opt/stacks). HTTPS from Caddy's usual automatic certificate; LAN only.
vault.dongar.net {
	# Anyone outside the LAN gets nothing. Caddy still answers Let's Encrypt's
	# checks, which it handles before the site's own routes.
	@outside not remote_ip private_ranges
	respond @outside 403

	reverse_proxy nisse.garrett-hall.com:3000
}