Josh Bairstow
7ecd1b32ae
Refactor the site container from a TLS-owning, port-binding proxy into an internal plaintext static server that sits behind a dedicated edge reverse proxy, and add an automated build/deploy pipeline. - Caddyfile: single :80 listener (auto_https off), Host-matcher routing for apex/blog/art/code with /_astro+/assets re-root and www->apex redirect - Dockerfile: EXPOSE 80 only (TLS now handled by the edge proxy) - compose.yml: pull registry image, join external 'edge' network, declare routing via caddy-docker-proxy labels; drop build/ports/cert volumes - compose.dev.yml: local container preview on :8080 - .forgejo/workflows/deploy.yml: push-to-main -> desktop runner builds, pushes to the Forgejo registry, SSH-deploys to the VPS - docs + .dockerignore updated for the new topology Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
863 B
Docker
25 lines
863 B
Docker
# ----------------------------------------------------------------------------
|
|
# jb-website — static build served by Caddy with automatic HTTPS.
|
|
# Multi-stage: node builds Astro, alpine Caddy serves the result.
|
|
# ----------------------------------------------------------------------------
|
|
|
|
# ---- build stage ------------------------------------------------------------
|
|
FROM node:24-alpine AS build
|
|
WORKDIR /app
|
|
|
|
# Install deps separately so they cache between source-only changes.
|
|
COPY package.json package-lock.json* ./
|
|
RUN npm ci
|
|
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# ---- runtime stage ----------------------------------------------------------
|
|
FROM caddy:2-alpine
|
|
|
|
COPY Caddyfile /etc/caddy/Caddyfile
|
|
COPY --from=build /app/dist /srv
|
|
|
|
# Internal plaintext server only — the edge reverse proxy terminates TLS and
|
|
# forwards to this port. No 443 here.
|
|
EXPOSE 80
|