grokbot_ty
adb50d971a
- Caddyfile: switch from :80 catch-all to slab.local with file-based TLS using self-signed cert from deploy/certs/ - docker-compose.yml: publish 443, mount certs volume read-only - INVENTORY.md: update smoke section with HTTPS results, note phone CA TBD Host fix: added slab.local → 192.168.1.202 to /etc/hosts, Caddy now serves HTTPS with HTTP→HTTPS redirect, curl -k https://slab.local/api/health returns 200 ok.
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
# Implementable compose for SlabUploader.
|
|
# From repo root:
|
|
# cp deploy/.env.example deploy/.env && chmod 600 deploy/.env
|
|
# docker compose -f deploy/docker-compose.yml --env-file deploy/.env up -d
|
|
# Bind loopback only. Caddy is the TLS edge. Services on the compose network
|
|
# are named `frontend` and `fastapi` (must match Caddyfile).
|
|
#
|
|
# WOO_BASE_URL is deploy-time SoT, HTTPS only. FastAPI must refuse http://
|
|
# at startup. Settings UI displays the URL read-only.
|
|
|
|
services:
|
|
frontend:
|
|
build:
|
|
context: ..
|
|
dockerfile: frontend/Dockerfile
|
|
ports: ["0.0.0.0:${FRONTEND_PORT:-18080}:80"]
|
|
depends_on: [fastapi]
|
|
restart: unless-stopped
|
|
|
|
fastapi:
|
|
build:
|
|
context: ..
|
|
dockerfile: backend/Dockerfile
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
SLAB_AES_KEY: ${SLAB_AES_KEY}
|
|
SLAB_WOO_BASE_URL: ${WOO_BASE_URL}
|
|
APP_HOSTNAME: ${APP_HOSTNAME:-}
|
|
# Woo Application Password + inference keys: AES-GCM in SQLite via Settings UI
|
|
volumes:
|
|
- slab_db:/data
|
|
- slab_images:/images
|
|
- ../backend/app/prompts:/app/prompts:ro
|
|
ports: ["0.0.0.0:${FASTAPI_PORT:-18081}:8000"]
|
|
mem_limit: 2g
|
|
restart: unless-stopped
|
|
|
|
caddy:
|
|
image: caddy:2.8.4
|
|
restart: unless-stopped
|
|
ports:
|
|
- "0.0.0.0:80:80"
|
|
- "0.0.0.0:443:443"
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile
|
|
- ./certs:/etc/caddy/certs:ro
|
|
depends_on:
|
|
- frontend
|
|
- fastapi
|
|
|
|
volumes:
|
|
slab_db:
|
|
slab_images:
|