Caddy server config file to restrict certain paths

caddyfile.md

Caddyfile — Weather Station Secure Reverse Proxy

oscar-ii Windows 11

Tailscale Funnel forwards public HTTPS traffic to Caddy on port 8080

Caddy acts as security gatekeeper — exposing only weather dashboards

:8080 { # Block sensitive CumulusMX admin and API paths @blocked { path /api/settings* path /api/station* path /api/info* path /set/* path /login* path /api/edit* path /api/forecast* } respond @blocked 403

# WeeWX dashboard only — restricts to /weewx/ path
# Blocks Apache default page and anything else on the Pi
handle /weewx/* {
    reverse_proxy 192.168.12.15:80
}

# CumulusMX — all other traffic (minus blocked paths above)
handle {
    reverse_proxy localhost:8998
}

}