Andreas Niemann
6a7c28b54c
foundation-caddy — the only public ingress (80/443 published), automatic TLS via
Let's Encrypt DNS-01 over Cloudflare. Standard caddy:2 lacks the DNS plugin, so
the egg builds a custom image on the VM (containers/caddy-cloudflare/Dockerfile:
xcaddy + caddy-dns/cloudflare@v0.2.4, base digests pinned) via a remote.Command
(ADR-007) whose stdout image id the container runs. The Caddyfile carries no
secrets — the CF token is read from the container env ({env.CF_API_TOKEN}) — and
is rendered + bind-mounted from the host. Routes forge -> Forgejo:3000 and
s3 -> RustFS:9000; Vault is intentionally not proxied publicly (CONTRACT_003
"restricted").
Live on cx33 Helsinki: certs obtained for forge + s3; https://forge.olsitec.net
= 502 (Forgejo lands in T08) and https://s3.olsitec.net = 403 (RustFS), both over
valid Let's Encrypt certs (DNS-01). Acceptance T07 met.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
15 lines
1 KiB
Docker
15 lines
1 KiB
Docker
# Custom Caddy image with the Cloudflare DNS-01 plugin (standard caddy:2 lacks it,
|
|
# and DNS-01 is how the egg gets TLS before/without HTTP reachability — PLAN-002
|
|
# §9.4). Built on the VM by components/proxy.ts (ADR-007); the resulting image id
|
|
# is what the foundation-caddy container runs.
|
|
#
|
|
# Determinism (D5): base images pinned by digest, DNS module pinned by version.
|
|
# Bump = edit this file → proxy.ts's build command rebuilds (Dockerfile is a trigger).
|
|
# builder caddy:2.10-builder sha256:01668408cc26e2e00c9d067c30cb43b2ba14ad1f2808beda55503cb2a31f59dc
|
|
# final caddy:2.10 sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
|
|
# module github.com/caddy-dns/cloudflare v0.2.4 (libdns/cloudflare v0.2.2)
|
|
FROM caddy@sha256:01668408cc26e2e00c9d067c30cb43b2ba14ad1f2808beda55503cb2a31f59dc AS builder
|
|
RUN xcaddy build --with github.com/caddy-dns/cloudflare@v0.2.4
|
|
|
|
FROM caddy@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
|
|
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
|