6afb196bec
Add Hephaestus/caddy/Caddyfile - Caddy reverse-proxies both containers on
{$SITE_HOSTNAME} (from docker-compose .env): /auth/* -> auth-proxy:4000 with
the prefix stripped, / -> forgejo:3000 with a 2GB body cap for git push, LFS,
and release uploads. HTTPS via automatic Lets Encrypt (HTTP-01 on :80); SSH
git access stays on 2222 outside Caddy.
docker-compose.yml wires the new caddy service alongside the two existing
containers; auth-proxy/src/index.ts gets the minor upstream adjustment so
paths line up after Caddy strips the /auth prefix.
26 lines
895 B
Caddyfile
26 lines
895 B
Caddyfile
# Caddy fronts the whole Hephaestus stack.
|
|
# - Automatic Let's Encrypt cert for code.silentmode.st (HTTP-01 challenge on :80)
|
|
# - Path-based routing:
|
|
# /auth/* → auth-proxy container (prefix stripped before forwarding)
|
|
# / → Forgejo container
|
|
# - HTTPS-only for browser traffic; SSH git access stays on port 2222 outside Caddy.
|
|
#
|
|
# {$SITE_HOSTNAME} is provided by docker-compose from .env (SITE_HOSTNAME).
|
|
|
|
{$SITE_HOSTNAME} {
|
|
encode gzip zstd
|
|
|
|
# Auth-proxy under /auth/*. handle_path STRIPS the /auth prefix before proxying,
|
|
# so /auth/challenge upstream is just /challenge on auth-proxy.
|
|
handle_path /auth/* {
|
|
reverse_proxy auth-proxy:4000
|
|
}
|
|
|
|
# Everything else → Forgejo. Big body size so git push + LFS + release uploads work.
|
|
handle {
|
|
reverse_proxy forgejo:3000
|
|
request_body {
|
|
max_size 2GB
|
|
}
|
|
}
|
|
}
|