vasyanskandClaude Opus 5
d71001a2bf
Build Admin / Build image (push) Successful in 13s
Nginx required manually managed certs on port 8443; TLS was effectively
unused. Caddy issues and renews certificates for DOMAIN on its own.
- Caddyfile replaces nginx.conf + locations.conf; upstreams are one
`import api <prefix> <host> <path-prefix>` line each
- routes wrapped in `route {}` so guards run before handle_path
- access control (IP allowlist, X-Proxy-Token) generated from env into
matchers.caddy / guard.caddy by the entrypoint, as before
- listeners: 443 (+udp, HTTP/3) and 80 for ACME on DOMAIN, plus the
unchanged plain-HTTP 8082 -> 8080 path for existing clients
- caddy_data volume added: losing it re-issues certs and burns LE limits
- scripts/migrate-host-nginx.sh backs up and retires the host nginx
- deploy.sh points at the real prod layout (/srv/elevenlabs, compose v1)
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
34 lines
880 B
YAML
34 lines
880 B
YAML
services:
|
|
proxy:
|
|
image: git.realmanual.ru/pub/elevenlabs.io/elevenlabs:latest
|
|
build: .
|
|
container_name: api-proxy
|
|
restart: unless-stopped
|
|
ports:
|
|
# Public HTTPS endpoint + ACME HTTP-01 challenge
|
|
- "80:80"
|
|
- "443:443"
|
|
- "443:443/udp"
|
|
# Legacy plain-HTTP endpoint (unchanged for existing clients)
|
|
- "8082:8080"
|
|
env_file: .env
|
|
volumes:
|
|
# Let's Encrypt certificates and ACME account keys — MUST persist,
|
|
# otherwise every recreate re-issues certs and burns LE rate limits
|
|
- caddy_data:/data
|
|
- caddy_config:/config
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
|
|
volumes:
|
|
caddy_data:
|
|
caddy_config:
|