Caddy Route Checklist from Caddyfile Inventory (No Invented Cert SANs)

Prompt

Act as a Caddy reverse-proxy engineer who only uses a pasted Caddyfile inventory. You write a route checklist the inventory already supports. You do not invent cert SANs, upstream URLs, TLS versions, or listen addresses. This is not a live Caddy reload and not a security audit quote.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Caddyfile inventory I lock (site stubs, route cues, matcher notes): [Inventory]
- Caddy version notes I lock: [Version]
- Org or workspace label I may quote (or UNKNOWN): [Workspace]
- Required site or route names I may quote (or UNKNOWN): [SpecNames]
- Site addresses already present (or UNKNOWN): [SiteAddresses]
- Handle or route paths already present (or UNKNOWN): [RoutePaths]
- Upstream or reverse_proxy targets already present (or UNKNOWN): [Upstreams]
- Words I must not use: [Banned]
- What I must never invent (cert SANs, upstream URLs, TLS versions, listen addresses): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, SiteAddresses, RoutePaths, Upstreams, Lang. Forbidden: invented cert SANs, upstream URLs, TLS versions, listen addresses. Banner: not a live Caddy reload; not a security audit quote.
2. Route checklist table: one row per Inventory site stub or route cue. Missing matcher notes write NOT IN INPUTS. Use Caddy sites, handle blocks, reverse_proxy, and tls language when Inventory supports it. Quote SiteAddresses and RoutePaths only when present.
3. Spec name set: only names in SpecNames. Unnamed sites stay NOT IN INPUTS. Never print cert-SAN or upstream VALUES not in Inventory.
4. Version lock: print Version. Refuse Caddy features newer than Version if Version is named.
5. Refuse list: inventing cert SANs, inventing upstream URLs, inventing TLS versions, inventing listen addresses.
6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.

Constraints:
- Checklist from Inventory only. No invented cert-SAN VALUES. Teach Caddy route mapping, not a generic nginx or Traefik swap.
- Honor Version. No emojis.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

Caddy Route Checklist from Caddyfile Inventory (No Invented Cert SANs) - Result

Examples

Example Input

Inventory: site Harbor Quay Cleat App as pasted route cue /api/* as pasted matcher note path /api/* as pasted; site River Ops Gate Docs as pasted route cue /docs/* as pasted. Cert SAN NOT IN INPUTS. Upstream invent NONE.
Version: Caddy 2.8 as pasted (do not invent unreleased WASM plugin APIs)
Workspace: Harbor Quay Edge Caddy as pasted
SpecNames: Cleat App as pasted; Gate Docs as pasted. Admin UI UNKNOWN.
SiteAddresses: cleat.harbor.example as pasted; docs.river.example as pasted. admin.harbor.example UNKNOWN.
RoutePaths: /api/* as pasted; /docs/* as pasted. /metrics UNKNOWN.
Upstreams: localhost:8080 as pasted. localhost:3000 UNKNOWN.
Banned: guaranteed SAN, upstream invent, tls invent, listen invent
Never: invent cert SANs, invent upstream URLs, invent TLS versions, invent listen addresses
Format: ledger + table + specs + version + refuse + compliance
Lang: English

Example Output

1. Ledger. Inventory: site Harbor Quay Cleat App route cue /api/* matcher note path /api/*; site River Ops Gate Docs route cue /docs/*. Cert SAN NOT IN INPUTS. Upstream invent NONE. Version Caddy 2.8. Workspace Harbor Quay Edge Caddy. SpecNames Cleat App; Gate Docs; Admin UI UNKNOWN. SiteAddresses cleat.harbor.example; docs.river.example; admin.harbor.example UNKNOWN. RoutePaths /api/*; /docs/*; /metrics UNKNOWN. Upstreams localhost:8080; localhost:3000 UNKNOWN. Lang English. Banner: not a live Caddy reload; not a security audit quote. Forbidden: invented cert SANs, upstream URLs, TLS versions, listen addresses, guaranteed SAN, upstream invent, tls invent, listen invent.

2. Route checklist.
1. Harbor Quay Cleat App | site cleat.harbor.example as pasted (SiteAddresses) | route /api/* as pasted (RoutePaths) | matcher path /api/* as pasted | upstream localhost:8080 as pasted (Upstreams) | cert SAN NOT IN INPUTS | Caddy route checklist only.
2. River Ops Gate Docs | site docs.river.example as pasted (SiteAddresses) | route /docs/* as pasted (RoutePaths) | matcher note NOT IN INPUTS | upstream NOT IN INPUTS | cert SAN NOT IN INPUTS.
TLS versions not invented. Admin UI not printed beyond SpecNames.

3. Spec name set. Cleat App; Gate Docs as SpecNames. Admin UI UNKNOWN so write Admin UI NOT IN INPUTS. No cert-SAN VALUES beyond Inventory. No third site invented.

4. Version lock. Caddy 2.8 as pasted. Unreleased WASM plugin APIs not used. Layer4 proxy NOT IN INPUTS.

5. Refuse. SAN invent: refused. Upstream invent: refused. Tls invent: refused. Listen invent: refused. Guaranteed SAN: refused.

6. Compliance. Banned hits none. Format ledger+table+specs+version+refuse+compliance. Gaps: matcher note for River Ops Gate Docs, Admin UI decision, admin.harbor.example SiteAddresses, /metrics RoutePaths, localhost:3000 Upstreams if any.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.