Oier Bravo Urtasun
3486546fb3
Make the caddy host-published port configurable (CADDY_HTTP_PORT / CADDY_HTTP_BIND, default 0.0.0.0:80 unchanged) so the machine's own nginx can terminate TLS and reverse-proxy to caddy on a localhost-only port. Add nginx/ulicraft-caddy.conf.tmpl: a TLS-terminator vhost set that proxies apex/auth/pack to caddy by Host header, letting caddy stay the single ingress for all routing. Alternative to ulicraft.conf.tmpl (nginx-as-static + drasl proxy). minecraft still reaches caddy internally over http via mcnet aliases. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
51 lines
2.5 KiB
YAML
51 lines
2.5 KiB
YAML
# ──────────────────────────────────────────────────────────────────
|
|
# Caddy ingress — LAN / air-gap path. NOT started with the base stack.
|
|
# ──────────────────────────────────────────────────────────────────
|
|
# Caddy was moved out of docker-compose.yml so the base stack can run behind
|
|
# the host's nginx (production) without it. build-stack.sh adds this file for
|
|
# its online/airgap/core modes; static/mirror overrides mount extra vhosts in.
|
|
#
|
|
# docker compose -f docker-compose.yml -f docker-compose.caddy.yml up -d
|
|
#
|
|
# Holds the mcnet aliases (auth./pack.${BASE_DOMAIN}) so containers resolve the
|
|
# stack's own names internally — this is why minecraft can reach the pack here
|
|
# without extra_hosts (the nginx path uses extra_hosts instead).
|
|
services:
|
|
caddy:
|
|
image: caddy:alpine
|
|
container_name: caddy
|
|
restart: unless-stopped
|
|
# Host-published port. Default 80 for the standalone LAN/air-gap path; set
|
|
# CADDY_HTTP_PORT to a high localhost-only port when the machine's nginx
|
|
# fronts caddy (nginx terminates TLS, reverse-proxies here by Host header —
|
|
# see nginx/ulicraft-caddy.conf.tmpl).
|
|
ports:
|
|
- "${CADDY_HTTP_BIND:-0.0.0.0}:${CADDY_HTTP_PORT:-80}:80"
|
|
environment:
|
|
BASE_DOMAIN: ${BASE_DOMAIN}
|
|
volumes:
|
|
- ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- ./caddy/conf.d/00-core.caddy:/etc/caddy/conf.d/00-core.caddy:ro
|
|
- ./caddy/conf.d/10-static.caddy:/etc/caddy/conf.d/10-static.caddy:ro
|
|
- ./www:/srv/www:ro
|
|
- ./mirror/launcher:/srv/launcher:ro
|
|
- ./caddy/caddy-root-ca.crt:/srv/ca-pub/ca.crt:ro
|
|
- ./pack:/srv/pack:ro
|
|
# Custom (locally-hosted) mod jars live OUTSIDE ./pack so packwiz refresh
|
|
# doesn't index them as direct files. Served at pack.${BASE_DOMAIN}/custom/.
|
|
- ./custom:/srv/pack/custom:ro
|
|
networks:
|
|
mcnet:
|
|
# The upstream spoof-host aliases live in docker-compose.mirror.yml —
|
|
# adding them here would hijack maven.neoforged.net etc. for ALL mcnet
|
|
# containers, breaking the ONLINE NeoForge install during pre-bake.
|
|
aliases:
|
|
- "auth.${BASE_DOMAIN}"
|
|
- "pack.${BASE_DOMAIN}"
|
|
|
|
# Restore the ordering the base file used to have (base drops it so it can run
|
|
# caddy-less behind nginx).
|
|
minecraft:
|
|
depends_on:
|
|
- caddy
|