vasyanskandClaude Opus 5
d71001a2bf
Build Admin / Build image (push) Successful in 13s
Nginx required manually managed certs on port 8443; TLS was effectively
unused. Caddy issues and renews certificates for DOMAIN on its own.
- Caddyfile replaces nginx.conf + locations.conf; upstreams are one
`import api <prefix> <host> <path-prefix>` line each
- routes wrapped in `route {}` so guards run before handle_path
- access control (IP allowlist, X-Proxy-Token) generated from env into
matchers.caddy / guard.caddy by the entrypoint, as before
- listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the
unchanged plain-HTTP 8082 -> 8080 path for existing clients
- caddy_data volume added: losing it re-issues certs and burns LE limits
- scripts/migrate-host-nginx.sh backs up and retires the host nginx
- deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1)
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
58 lines
1.6 KiB
Bash
Executable File
58 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# elevenlabs.io/docker-entrypoint.sh
|
|
# Generates Caddy access-control fragments from environment variables at container start.
|
|
set -e
|
|
|
|
CONF_DIR="/etc/caddy"
|
|
MATCHERS="${CONF_DIR}/matchers.caddy"
|
|
GUARD="${CONF_DIR}/guard.caddy"
|
|
|
|
: > "${MATCHERS}"
|
|
: > "${GUARD}"
|
|
|
|
# --- 0. Required settings ---
|
|
if [ -z "${DOMAIN}" ]; then
|
|
echo "[entrypoint] FATAL: DOMAIN is not set (e.g. proxy.example.com)" >&2
|
|
exit 1
|
|
fi
|
|
if [ -z "${ACME_EMAIL}" ]; then
|
|
echo "[entrypoint] FATAL: ACME_EMAIL is not set — Let's Encrypt account needs it" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# --- 1. IP allowlist ---
|
|
if [ -z "${ALLOWED_CIDR}" ]; then
|
|
echo "[entrypoint] ALLOWED_CIDR is empty — allowing all IPs (dev mode)"
|
|
else
|
|
CIDR_LIST=$(echo "${ALLOWED_CIDR}" | tr ',' ' ' | tr -s ' ')
|
|
cat >> "${MATCHERS}" <<MATCH
|
|
@denied_ip not remote_ip ${CIDR_LIST}
|
|
MATCH
|
|
cat >> "${GUARD}" <<GUARDRULE
|
|
respond @denied_ip \`{"error":"ip_not_allowed"}\` 403 {
|
|
close
|
|
}
|
|
GUARDRULE
|
|
echo "[entrypoint] IP allowlist configured: ${CIDR_LIST}"
|
|
fi
|
|
|
|
# --- 2. Token auth ---
|
|
if [ -z "${PROXY_SECRET}" ]; then
|
|
echo "[entrypoint] PROXY_SECRET is not set — token auth disabled (open mode)"
|
|
else
|
|
cat >> "${MATCHERS}" <<MATCH
|
|
@bad_token not header X-Proxy-Token "${PROXY_SECRET}"
|
|
MATCH
|
|
cat >> "${GUARD}" <<GUARDRULE
|
|
respond @bad_token \`{"error":"invalid_token"}\` 403 {
|
|
close
|
|
}
|
|
GUARDRULE
|
|
echo "[entrypoint] Token auth configured"
|
|
fi
|
|
|
|
# --- 3. Validate and start ---
|
|
caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
|
|
echo "[entrypoint] Starting caddy (domain: ${DOMAIN})..."
|
|
exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
|