6afb196bec
Add Hephaestus/caddy/Caddyfile - Caddy reverse-proxies both containers on
{$SITE_HOSTNAME} (from docker-compose .env): /auth/* -> auth-proxy:4000 with
the prefix stripped, / -> forgejo:3000 with a 2GB body cap for git push, LFS,
and release uploads. HTTPS via automatic Lets Encrypt (HTTP-01 on :80); SSH
git access stays on 2222 outside Caddy.
docker-compose.yml wires the new caddy service alongside the two existing
containers; auth-proxy/src/index.ts gets the minor upstream adjustment so
paths line up after Caddy strips the /auth prefix.
105 lines
3.7 KiB
YAML
105 lines
3.7 KiB
YAML
services:
|
|
caddy:
|
|
image: caddy:2-alpine
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
- "443:443/udp" # HTTP/3
|
|
environment:
|
|
SITE_HOSTNAME: ${SITE_HOSTNAME}
|
|
volumes:
|
|
- ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy-data:/data
|
|
- caddy-config:/config
|
|
depends_on:
|
|
- forgejo
|
|
- auth-proxy
|
|
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
auth-proxy:
|
|
build: ./auth-proxy
|
|
restart: unless-stopped
|
|
environment:
|
|
ISSUER: ${AUTH_PROXY_ISSUER}
|
|
CLIENT_ID: ${AUTH_PROXY_CLIENT_ID}
|
|
CLIENT_SECRET: ${AUTH_PROXY_CLIENT_SECRET}
|
|
CHALLENGE_DOMAIN: ${AUTH_PROXY_CHALLENGE_DOMAIN}
|
|
FORGEJO_REDIRECT_URI: ${FORGEJO_ROOT_URL}user/oauth2/hephaestus-wallet/callback
|
|
# Caddy proxies /auth/* → auth-proxy:4000 over the internal network. No public port.
|
|
expose:
|
|
- "4000"
|
|
volumes:
|
|
- auth-proxy-keys:/data
|
|
|
|
forgejo:
|
|
image: codeberg.org/forgejo/forgejo:10
|
|
restart: unless-stopped
|
|
environment:
|
|
USER_UID: "1000"
|
|
USER_GID: "1000"
|
|
FORGEJO__database__DB_TYPE: postgres
|
|
FORGEJO__database__HOST: postgres:5432
|
|
FORGEJO__database__NAME: ${POSTGRES_DB}
|
|
FORGEJO__database__USER: ${POSTGRES_USER}
|
|
FORGEJO__database__PASSWD: ${POSTGRES_PASSWORD}
|
|
FORGEJO__server__DOMAIN: ${FORGEJO_DOMAIN}
|
|
FORGEJO__server__ROOT_URL: ${FORGEJO_ROOT_URL}
|
|
FORGEJO__security__SECRET_KEY: ${FORGEJO_SECRET_KEY}
|
|
FORGEJO__security__INTERNAL_TOKEN: ${FORGEJO_INTERNAL_TOKEN}
|
|
FORGEJO__oauth2__JWT_SECRET: ${FORGEJO_OAUTH_JWT_SECRET}
|
|
# --- Storage backend: local disk for MVP ---
|
|
# sia.storage as S3 backend is deferred until the endpoint TLS cert chains cleanly
|
|
# (currently requires --no-verify-ssl which Forgejo's minio driver won't accept).
|
|
# Storage-on-disk works; the switch back to S3 is a config change only, no rebuild.
|
|
# (defaults to local — no MINIO_* env vars needed)
|
|
# --- Quota (free tier: 500 MB per user) ---
|
|
FORGEJO__quota__ENABLED: "true"
|
|
FORGEJO__quota__DEFAULT_GROUPS: free
|
|
# --- Registration + signin ---
|
|
# Local form is disabled via SHOW_REGISTRATION_BUTTON=false + ALLOW_ONLY_EXTERNAL_REGISTRATION=true.
|
|
# DISABLE_REGISTRATION must stay FALSE — it blocks OIDC auto-provisioning too, not just the form.
|
|
FORGEJO__service__DISABLE_REGISTRATION: "false"
|
|
FORGEJO__service__SHOW_REGISTRATION_BUTTON: "false"
|
|
FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
|
|
# OIDC callback creates users automatically using the preferred_username claim (= cashaddr).
|
|
FORGEJO__oauth2_client__ENABLE_AUTO_REGISTRATION: "true"
|
|
FORGEJO__oauth2_client__ACCOUNT_LINKING: "auto"
|
|
FORGEJO__oauth2_client__USERNAME: "preferred_username"
|
|
FORGEJO__oauth2_client__UPDATE_AVATAR: "false"
|
|
# Skip the web installer wizard — everything is already configured
|
|
FORGEJO__server__INSTALL_LOCK: "true"
|
|
# Caddy proxies / → forgejo:3000 over the internal network. No public HTTP port.
|
|
# 22 stays on 2222 for git-over-SSH (no TLS involved).
|
|
expose:
|
|
- "3000"
|
|
ports:
|
|
- "2222:22"
|
|
volumes:
|
|
- forgejo-data:/data
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
auth-proxy:
|
|
condition: service_started
|
|
|
|
volumes:
|
|
postgres-data:
|
|
forgejo-data:
|
|
auth-proxy-keys:
|
|
caddy-data:
|
|
caddy-config:
|