Josh Bairstow
7ecd1b32ae
Refactor the site container from a TLS-owning, port-binding proxy into an internal plaintext static server that sits behind a dedicated edge reverse proxy, and add an automated build/deploy pipeline. - Caddyfile: single :80 listener (auto_https off), Host-matcher routing for apex/blog/art/code with /_astro+/assets re-root and www->apex redirect - Dockerfile: EXPOSE 80 only (TLS now handled by the edge proxy) - compose.yml: pull registry image, join external 'edge' network, declare routing via caddy-docker-proxy labels; drop build/ports/cert volumes - compose.dev.yml: local container preview on :8080 - .forgejo/workflows/deploy.yml: push-to-main -> desktop runner builds, pushes to the Forgejo registry, SSH-deploys to the VPS - docs + .dockerignore updated for the new topology Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
35 lines
1.6 KiB
YAML
35 lines
1.6 KiB
YAML
# ----------------------------------------------------------------------------
|
|
# jb-website — PRODUCTION compose (lives on the VPS at /opt/jb-website/).
|
|
#
|
|
# This file does NOT build. The image is built on the home-desktop CI runner
|
|
# and pushed to the Forgejo container registry; the VPS only pulls and runs it.
|
|
# The deploy step (see .forgejo/workflows/deploy.yml) does:
|
|
#
|
|
# TAG=<commit-sha> docker compose -f /opt/jb-website/compose.yml pull
|
|
# TAG=<commit-sha> docker compose -f /opt/jb-website/compose.yml up -d
|
|
#
|
|
# Routing + TLS are handled by the edge proxy (caddy-docker-proxy, infra repo).
|
|
# This service is internal-only: no published ports, no certs. It joins the
|
|
# shared external `edge` network and declares its hostnames via labels; the edge
|
|
# proxy discovers them and reverse-proxies (plaintext, Host preserved) to :80.
|
|
#
|
|
# For local preview use compose.dev.yml instead (this file won't run off-VPS
|
|
# because the `edge` network is external).
|
|
# ----------------------------------------------------------------------------
|
|
|
|
services:
|
|
web:
|
|
# REGISTRY_OWNER must be the lowercase Forgejo owner (user/org). TAG is the
|
|
# commit sha set by the deploy step; falls back to latest for manual `up`.
|
|
image: git.joshbairstow.com/${REGISTRY_OWNER:-josh}/jb-website:${TAG:-latest}
|
|
container_name: jb-website
|
|
restart: unless-stopped
|
|
networks:
|
|
- edge
|
|
labels:
|
|
caddy: joshbairstow.com, www.joshbairstow.com, blog.joshbairstow.com, art.joshbairstow.com, code.joshbairstow.com
|
|
caddy.reverse_proxy: "{{upstreams 80}}"
|
|
|
|
networks:
|
|
edge:
|
|
external: true
|