Tizian 「ティツィアーン」
af3a01907e
Caddy, the Serverpod server and PostgreSQL 16 in deploy/. Only Caddy publishes ports; the server and Postgres are reachable only inside the Compose network (Docker bypasses ufw, and the server listens on every interface). Secrets come from deploy/.env as environment variables; there is no production passwords.yaml, and .dockerignore keeps local secrets out of the build context. The server image builds on Serverpod's template with an Ubuntu 24.04 runtime: complete glibc incl. libgcc_s for the SQLite libraries Serverpod 4 bundles, CA certificates, a non-root user, and exec so SIGTERM reaches the server. The scaffold's dev-only docker-compose.yaml is removed. Verified locally: image builds, all native libraries resolve, no passwords.yaml in the image, migrations apply at start, Caddy serves 200, port 8080 unreachable from the host, Postgres in UTC. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
12 lines
513 B
Caddyfile
12 lines
513 B
Caddyfile
# Caddy forwards to the API server only. Insights (8081) and a web server (8082) don't
|
|
# run in production; if Insights is ever re-enabled, reach it through an SSH tunnel,
|
|
# never through this file.
|
|
#
|
|
# {$DOMAIN} is `learn.halkyon.eu` on sahaquiel, where Caddy obtains and renews a
|
|
# Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
|
|
{$DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
# Serverpod's streaming methods use WebSockets; reverse_proxy upgrades them as-is.
|
|
reverse_proxy server:8080
|
|
}
|