Files

Oier Bravo Urtasun 35be2e6b76 docs(plan): scrub stale pack subdomain + packwiz from live-arch docs

The pack./packwiz service was removed operationally long ago, but several
plan docs still presented pack. as a live caddy vhost / DNS subdomain and
render-pack.sh as a current tool. Remove those references from the
current-architecture docs (overview, caddy, tooling, uptime-kuma,
letsencrypt, mc-backup); leave the migration log (04-mods.md), superseded
banner (04-packwiz.md), commit history (12-build-order.md), and planned
landing rework (18) intact as deliberate history.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-22 20:15:22 +02:00

2.4 KiB

Raw Blame History

Caddy — internal router behind host nginx

Summary

caddy is the stack's internal HTTP router, sitting behind the host's own nginx (which terminates TLS — see 15-letsencrypt.md). caddy is published only on a localhost-only port (CADDY_HTTP_BIND=127.0.0.1, CADDY_HTTP_PORT=8880); nginx reverse-proxies every public vhost to it by Host header. Roles:

Reverse proxy — auth. → drasl, avatar. → nmsr, status. → uptime-kuma.
Static — apex serves the landing page + /launcher/ downloads; distribution. serves a static site from another repo.

Image: caddy:alpine. caddy natively reads {$BASE_DOMAIN} env placeholders — no template render needed.

Network aliases (internal resolution)

caddy:
  networks:
    mcnet:
      aliases:
        - "auth.${BASE_DOMAIN}"

Lets minecraft reach http://auth.ulicraft.net/authlib-injector from inside the stack.

conf.d snippets

The Caddyfile imports per-vhost snippets from caddy/conf.d/:

00-core.caddy — auth. → drasl.
10-static.caddy — apex landing (/srv/www) + /launcher/* (/srv/launcher).
30-distribution.caddy — distribution. → /srv/distribution (static, from DISTRIBUTION_WEB_ROOT, another repo).
40-avatar.caddy — avatar. → nmsr:8080 (skin/avatar renderer).
50-status.caddy — status. → uptime-kuma:3001 (status page).

All vhosts are plain http://…; TLS is nginx's job. Mounts: ./www:/srv/www:ro, ./launcher:/srv/launcher:ro, ${DISTRIBUTION_WEB_ROOT}:/srv/distribution:ro.

Notes / risks

drasl behind a proxy: with matching BaseURL and nginx terminating TLS it is fine; nginx passes the original Host through to caddy → drasl.
/launcher/ is a sibling mount (/srv/launcher), not nested under the read-only /srv/www; handle_path strips the prefix.

Tasks

caddy service in docker-compose.yml, published 127.0.0.1:${CADDY_HTTP_PORT}:80
Pass BASE_DOMAIN + DISTRIBUTION_WEB_ROOT into caddy env
Caddyfile imports conf.d/*.caddy
Network alias for auth. subdomain
Mount ./www, ./launcher, ${DISTRIBUTION_WEB_ROOT}
Confirm reverse_proxy to drasl works (auth web UI loads, Yggdrasil API responds)
Verify internal alias resolution from minecraft container (curl authlib-injector)
Verify nmsr + uptime-kuma proxied (avatar. renders, status. loads)

2.4 KiB Raw Blame History