Tizian 「ティツィアーン」
4b45cacfa4
An instance may now run services beside itself, each a compose file of its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose. jellyfin.yaml), so the deploy runs them with the instance. The first is Jellyfin, which people watch and listen to learn from: the instance then suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its site, refusing every change to a user from outside, so a passwordless demo account stays everyone's; its admin signs in through an SSH tunnel. The instance's compose gets a second network, `edge`, for Caddy (at a fixed address, which sidecars trust as their proxy) and the server; Postgres stays on the internal one. Caddy loses its needless way to Postgres, and a sidecar never gains one. A sidecar publishes no port, as the CI runner may reach 127.0.0.1, and runs as a user ID of its own. Caddy imports the sidecars' sites from sidecars/, mounted by their compose files (none without), and redeploy.sh recreates it when one changes. sidecars/README.md has the steps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
25 lines
1 KiB
Caddyfile
25 lines
1 KiB
Caddyfile
# Caddy forwards to the API server, and the assistant connector's paths (ADR 0006) to
|
|
# the web server (8082), which serves nothing else. Insights (8081) doesn't run in
|
|
# production; if it is ever re-enabled, reach it through an SSH tunnel, never through
|
|
# this file.
|
|
#
|
|
# {$DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
|
|
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
|
|
{$DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
# The assistant connector: the MCP endpoint, its OAuth pages, and their metadata.
|
|
@connector path /mcp /oauth/* /.well-known/oauth-protected-resource /.well-known/oauth-protected-resource/* /.well-known/oauth-authorization-server
|
|
handle @connector {
|
|
reverse_proxy server:8082
|
|
}
|
|
|
|
# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
|
|
handle {
|
|
reverse_proxy server:8080
|
|
}
|
|
}
|
|
|
|
# The sites of the sidecars switched on (sidecars/README.md), which their compose files
|
|
# mount into sidecars/; none without.
|
|
import sidecars/*.caddy
|