Oier Bravo Urtasun
3486546fb3
Make the caddy host-published port configurable (CADDY_HTTP_PORT / CADDY_HTTP_BIND, default 0.0.0.0:80 unchanged) so the machine's own nginx can terminate TLS and reverse-proxy to caddy on a localhost-only port. Add nginx/ulicraft-caddy.conf.tmpl: a TLS-terminator vhost set that proxies apex/auth/pack to caddy by Host header, letting caddy stay the single ingress for all routing. Alternative to ulicraft.conf.tmpl (nginx-as-static + drasl proxy). minecraft still reaches caddy internally over http via mcnet aliases. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
2.3 KiB
Plaintext
53 lines
2.3 KiB
Plaintext
# Copy to .env and fill in real values
|
|
|
|
# Single base domain for the whole stack; every service is a subdomain of this.
|
|
# Use .lan (NOT .local) — .local is intercepted by mDNS on macOS/Linux and
|
|
# won't resolve through a normal unicast DNS server.
|
|
BASE_DOMAIN=ulicraft.lan
|
|
# The Docker host's LAN IP — every service name resolves here.
|
|
HOST_LAN_IP=192.168.1.10
|
|
|
|
# mDNS toggle. true + BASE_DOMAIN=*.local → an Avahi container publishes the
|
|
# service names over mDNS (zero-config for macOS/Linux guests; Windows needs
|
|
# Bonjour). false → use your own party DNS (records: tooling/dns-records.sh).
|
|
# NOTE: mDNS resolves ONLY *.local; it cannot serve the air-gap upstream-host
|
|
# spoofs — those always need a real DNS server.
|
|
ENABLE_MDNS=false
|
|
|
|
RCON_PASSWORD=change-me-to-something-random
|
|
|
|
# Caddy host-published port (docker-compose.caddy.yml). Default 80 for the
|
|
# standalone LAN/air-gap path. When the machine's own nginx fronts caddy
|
|
# (nginx terminates TLS → reverse-proxies to caddy), set a high port and bind
|
|
# it to localhost so only nginx reaches it:
|
|
# CADDY_HTTP_PORT=8880
|
|
# CADDY_HTTP_BIND=127.0.0.1
|
|
# Then render nginx/ulicraft-caddy.conf.tmpl with CADDY_HTTP_PORT.
|
|
# CADDY_HTTP_PORT=80
|
|
# CADDY_HTTP_BIND=0.0.0.0
|
|
# Only needed if using CurseForge-exclusive mods:
|
|
# CF_API_KEY=your-curseforge-api-key
|
|
|
|
# ── Let's Encrypt via OVH DNS-01 (tooling/issue-letsencrypt.sh) ───────
|
|
# Only needed to issue real TLS certs. DNS-01 needs no inbound ports.
|
|
LE_EMAIL=you@example.com
|
|
# space-separated subdomains; apex ${BASE_DOMAIN} is always included
|
|
LE_SUBDOMAINS=auth pack
|
|
# OVH API creds (DNS zone write). Create at https://eu.api.ovh.com/createToken/
|
|
# OVH_CK can be blank on first run — acme.sh prints an auth URL, then paste it.
|
|
OVH_END_POINT=ovh-eu
|
|
OVH_AK=
|
|
OVH_AS=
|
|
OVH_CK=
|
|
# LE_STAGING=1 # use the untrusted staging CA for dry runs
|
|
|
|
# ── Blessing Skin auth variant (docker-compose.blessingskin.yml) ──────
|
|
# Only needed when running the Blessing Skin override instead of Drasl.
|
|
BS_DB_NAME=blessingskin
|
|
BS_DB_USER=blessingskin
|
|
BS_DB_PASSWORD=change-me-bs-db
|
|
BS_DB_ROOT_PASSWORD=change-me-bs-root
|
|
# Generate once and paste here so it survives container recreates:
|
|
# docker run --rm azusamikan/blessing-skin-server-docker:latest php artisan key:generate --show
|
|
BS_APP_KEY=base64:replace-with-generated-key
|