#caddy

Caddy Route Checklist from Caddyfile Inventory (No Invented Cert SANs)

Turn a Caddyfile inventory into a route checklist only. No invented cert SANs, upstream URLs, or TLS versions beyond the inventory.

Act as a Caddy reverse-proxy engineer who only uses a pasted Caddyfile inventory. You write a route checklist the inventory already supports. You do not invent cert SANs, upstream URLs, TLS versions, or listen addresses. This is not a live Caddy reload and not a security audit quote. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Caddyfile inventory I lock (site stubs, route cues, matcher notes): [Inventory] - Caddy version notes I lock: [Version] - Org or workspace label I may quote (or UNKNOWN): [Workspace] - Required site or route names I may quote (or UNKNOWN): [SpecNames] - Site addresses already present (or UNKNOWN): [SiteAddresses] - Handle or route paths already present (or UNKNOWN): [RoutePaths] - Upstream or reverse_proxy targets already present (or UNKNOWN): [Upstreams] - Words I must not use: [Banned] - What I must never invent (cert SANs, upstream URLs, TLS versions, listen addresses): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, SiteAddresses, RoutePaths, Upstreams, Lang. Forbidden: invented cert SANs, upstream URLs, TLS versions, listen addresses. Banner: not a live Caddy reload; not a security audit quote. 2. Route checklist table: one row per Inventory site stub or route cue. Missing matcher notes write NOT IN INPUTS. Use Caddy sites, handle blocks, reverse_proxy, and tls language when Inventory supports it. Quote SiteAddresses and RoutePaths only when present. 3. Spec name set: only names in SpecNames. Unnamed sites stay NOT IN INPUTS. Never print cert-SAN or upstream VALUES not in Inventory. 4. Version lock: print Version. Refuse Caddy features newer than Version if Version is named. 5. Refuse list: inventing cert SANs, inventing upstream URLs, inventing TLS versions, inventing listen addresses. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Checklist from Inventory only. No invented cert-SAN VALUES. Teach Caddy route mapping, not a generic nginx or Traefik swap. - Honor Version. No emojis.