fix(self-hosting): correct compose probes and origins (#2330)

2026-09-02 21:04:06 +03:00 · 2026-09-01 20:47:20 +02:00
parent 7900a4da0c
commit 961fa1f007
3 changed files with 158 additions and 47 deletions
@@ -1,8 +1,41 @@
 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
 FLUXER_PUBLIC_PORT=443
+FLUXER_PUBLIC_ORIGIN=${FLUXER_PUBLIC_SCHEME}://${FLUXER_DOMAIN}
 FLUXER_CADDY_SITE_ADDRESS=chat.example.com

+# FLUXER_PUBLIC_ORIGIN is the origin browsers see. It must carry the port
+# whenever FLUXER_PUBLIC_PORT is not the default for its scheme, because an
+# origin written with a default port never matches a browser Origin header.
+# Serving on any other port means setting all three, plus the published port
+# below, and pointing FLUXER_CADDY_SITE_ADDRESS at the same scheme and host.
+# Compose expands this file from top to bottom, so FLUXER_PUBLIC_ORIGIN has to
+# stay below the two values it reads. Above them it silently expands to a bare
+# host with a trailing colon.
+#FLUXER_PUBLIC_SCHEME=http
+#FLUXER_PUBLIC_PORT=19080
+#FLUXER_PUBLIC_ORIGIN=${FLUXER_PUBLIC_SCHEME}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT}
+#FLUXER_HTTP_PORT=19080
+
+# Ports Caddy publishes on the host. Caddy still listens on 80 and 443 inside
+# the container, so change only these when something else already owns the
+# standard ports or another proxy sits in front. Both take an optional bind
+# address in front of the port, and 127.0.0.1 keeps the publish off every
+# public interface. FLUXER_HTTPS_PORT moves the TCP and the UDP publish
+# together, because HTTP/3 needs both on the same port.
+#FLUXER_HTTP_PORT=80
+#FLUXER_HTTPS_PORT=443
+#FLUXER_HTTP_PORT=127.0.0.1:80
+#FLUXER_HTTPS_PORT=127.0.0.1:443
+
+# A tunnel or another proxy in front of the stack needs no HTTPS publish at all.
+# tunnel.compose.yml ships beside this file and replaces Caddy's published ports
+# with a single loopback HTTP publish, so nothing binds 443. FLUXER_HTTP_PORT
+# still moves that one publish. Set the line below and plain docker compose
+# commands pick the file up, or add it to your own -f flags if you pass any. The
+# file uses the !override tag, which needs Compose 2.24.4 or newer.
+#COMPOSE_FILE=docker-compose.yml:tunnel.compose.yml
+
 FLUXER_REGISTRY_OWNER=fluxerapp
 FLUXER_REGISTRY=ghcr.io/${FLUXER_REGISTRY_OWNER}
 FLUXER_IMAGE_TAG=v1
@@ -30,6 +63,7 @@ FLUXER_VAPID_EMAIL=admin@example.com
 #FLUXER_PASSKEY_RP_ID=chat.example.com
 #FLUXER_PASSKEY_RP_NAME=Fluxer
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=https://chat.example.com
+#FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=http://chat.example.com:19080

 # Extra Content-Security-Policy sources, appended to the built-in ones. Set these
 # only when a browser must reach an origin the defaults do not cover, such as a
@@ -49,6 +83,20 @@ FLUXER_VAPID_EMAIL=admin@example.com
 LIVEKIT_API_KEY=fluxer
 LIVEKIT_API_SECRET=CHANGE_ME

+# Ports LiveKit publishes on the host for voice and video media. They take the
+# same optional bind address as the Caddy ports above. This media does not pass
+# through Caddy or through a tunnel, so it needs these ports reachable from
+# clients. LiveKit advertises the port numbers from livekit.yaml, so publishing
+# them on different host ports means changing that file too.
+#FLUXER_LIVEKIT_TCP_PORT=7881
+#FLUXER_LIVEKIT_UDP_PORT=7882
+
+# The voice server URL clients connect to. It defaults to FLUXER_PUBLIC_ORIGIN
+# plus /livekit, which the bundled Caddy proxies to the LiveKit container. Set
+# it only when LiveKit lives on its own host, and add that origin to
+# FLUXER_CSP_EXTRA_CONNECT_SRC when you do.
+#FLUXER_LIVEKIT_URL=wss://voice.example.com
+
 FLUXER_KLIPY_API_KEY=

 FLUXER_EMAIL_ENABLED=false
@@ -55,6 +55,7 @@ x-fluxer-env: &fluxer-env
  FLUXER_LIVEKIT_INTERNAL_URL: http://livekit:7880
  FLUXER_LIVEKIT_WEBHOOK_URL: http://api:8080/webhooks/livekit
  FLUXER_LIVEKIT_DEFAULT_REGION: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}'
+  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/livekit}

  FLUXER_KLIPY_API_KEY: ${FLUXER_KLIPY_API_KEY:-}

@@ -85,7 +86,7 @@ x-fluxer-env: &fluxer-env
  FLUXER_VAPID_EMAIL: ${FLUXER_VAPID_EMAIL:-admin@${FLUXER_DOMAIN}}
  FLUXER_PASSKEY_RP_ID: ${FLUXER_PASSKEY_RP_ID:-${FLUXER_DOMAIN}}
  FLUXER_PASSKEY_RP_NAME: ${FLUXER_PASSKEY_RP_NAME:-Fluxer}
-  FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+  FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
  FLUXER_GATEWAY_RPC_AUTH_TOKEN: ${FLUXER_GATEWAY_RPC_AUTH_TOKEN:?set FLUXER_GATEWAY_RPC_AUTH_TOKEN in .env}
  FLUXER_MEDIA_PROXY_SECRET_KEY: ${FLUXER_MEDIA_PROXY_SECRET_KEY:?set FLUXER_MEDIA_PROXY_SECRET_KEY in .env}
  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64:?set FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 in .env}
@@ -95,15 +96,23 @@ x-fluxer-env: &fluxer-env
  FLUXER_INTERNAL_API_ENDPOINT: http://api:8080
  FLUXER_INTERNAL_GATEWAY_ENDPOINT: http://gateway:8080
  FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
+  FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
  FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+  FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media

 x-fluxer-service: &fluxer-service
  restart: unless-stopped
  networks: [fluxer]

+x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck
+  test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8090 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
+  interval: 10s
+  timeout: 5s
+  retries: 30
+  start_period: 60s
+  start_interval: 1s
+
 services:
  caddy:
    image: caddy:2.10-alpine
@@ -114,15 +123,20 @@ services:
    restart: unless-stopped
    networks: [fluxer]
    ports:
-      - "80:80"
-      - "443:443"
-      - "443:443/udp"
+      - "${FLUXER_HTTP_PORT:-80}:80"
+      - "${FLUXER_HTTPS_PORT:-443}:443"
+      - "${FLUXER_HTTPS_PORT:-443}:443/udp"
    environment:
      FLUXER_CADDY_SITE_ADDRESS: ${FLUXER_CADDY_SITE_ADDRESS:?set FLUXER_CADDY_SITE_ADDRESS in .env}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
    depends_on:
      api: {condition: service_started}
      gateway: {condition: service_healthy}
@@ -207,6 +221,11 @@ services:
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8222/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  meilisearch:
    image: getmeili/meilisearch:v1.12
@@ -223,6 +242,11 @@ services:
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
    volumes:
      - meilisearch-data:/meili_data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7700/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  seaweedfs:
    image: chrislusf/seaweedfs:4.34
@@ -235,6 +259,11 @@ services:
    command: ["server", "-s3", "-dir=/data"]
    volumes:
      - seaweedfs-data:/data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8333/"]
+      interval: 10s
+      timeout: 5s
+      retries: 20

  seaweedfs-init:
    image: chrislusf/seaweedfs:4.34
@@ -243,7 +272,8 @@ services:
        limits:
          memory: ${FLUXER_SEAWEEDFS_INIT_MEMORY_LIMIT:-128mb}
    networks: [fluxer]
-    depends_on: [seaweedfs]
+    depends_on:
+      seaweedfs: {condition: service_healthy}
    restart: "no"
    entrypoint:
      - /bin/sh
@@ -289,6 +319,11 @@ services:
    ports:
      - "${FLUXER_LIVEKIT_TCP_PORT:-7881}:7881"
      - "${FLUXER_LIVEKIT_UDP_PORT:-7882}:7882/udp"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7880/"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  api:
    <<: *fluxer-service
@@ -315,17 +350,17 @@ services:
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
-      nats: {condition: service_started}
-      meilisearch: {condition: service_started}
+      nats: {condition: service_healthy}
+      meilisearch: {condition: service_healthy}
      seaweedfs-init: {condition: service_completed_successfully}
-      gifs: {condition: service_started}
-      gifs-shard: {condition: service_started}
-      snowflakes: {condition: service_started}
-      snowflakes-shard: {condition: service_started}
-      messages: {condition: service_started}
-      messages-shard: {condition: service_started}
-      users: {condition: service_started}
-      users-shard: {condition: service_started}
+      gifs: {condition: service_healthy}
+      gifs-shard: {condition: service_healthy}
+      snowflakes: {condition: service_healthy}
+      snowflakes-shard: {condition: service_healthy}
+      messages: {condition: service_healthy}
+      messages-shard: {condition: service_healthy}
+      users: {condition: service_healthy}
+      users-shard: {condition: service_healthy}

  worker:
    <<: *fluxer-service
@@ -355,11 +390,11 @@ services:
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      seaweedfs-init: {condition: service_completed_successfully}
-      snowflakes-shard: {condition: service_started}
-      messages-shard: {condition: service_started}
-      users-shard: {condition: service_started}
+      snowflakes-shard: {condition: service_healthy}
+      messages-shard: {condition: service_healthy}
+      users-shard: {condition: service_healthy}

  gateway:
    <<: *fluxer-service
@@ -373,8 +408,8 @@ services:
    environment:
      <<: *fluxer-env
      FLUXER_GATEWAY_PORT: "8080"
-      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
      FLUXER_GATEWAY_LOGGER_LEVEL: info
    healthcheck:
      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/_health/ready"]
@@ -383,7 +418,7 @@ services:
      retries: 30
      start_period: 90s
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      valkey: {condition: service_healthy}

  media-proxy:
@@ -399,11 +434,9 @@ services:
      FLUXER_MEDIA_PROXY_PORT: "8080"
      FLUXER_MEDIA_PROXY_MODE: upload
      FLUXER_MEDIA_PROXY_STORAGE_BACKEND: s3
-    healthcheck:
-      disable: true
    depends_on:
      seaweedfs-init: {condition: service_completed_successfully}
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  static-proxy:
    <<: *fluxer-service
@@ -412,6 +445,11 @@ services:
      resources:
        limits:
          memory: ${FLUXER_STATIC_PROXY_MEMORY_LIMIT:-256mb}
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/avatars/0.png"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  app-proxy:
    <<: *fluxer-service
@@ -426,7 +464,7 @@ services:
      FLUXER_APP_PROXY_PORT: "8080"
      DISCOVERY_UPSTREAM_URL: http://caddy:8088/api/.well-known/fluxer
      PUBLIC_BOOTSTRAP_API_ENDPOINT: /api
-      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/api
+      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api
      FLUXER_CSP_EXTRA_DEFAULT_SRC: ${FLUXER_CSP_EXTRA_DEFAULT_SRC:-}
      FLUXER_CSP_EXTRA_CONNECT_SRC: ${FLUXER_CSP_EXTRA_CONNECT_SRC:-}
      FLUXER_CSP_EXTRA_IMG_SRC: ${FLUXER_CSP_EXTRA_IMG_SRC:-}
@@ -441,7 +479,7 @@ services:
      FLUXER_POSTGRES_MAX_CONNECTIONS: "5"
    depends_on:
      api: {condition: service_healthy}
-      caddy: {condition: service_started}
+      caddy: {condition: service_healthy}
      postgres: {condition: service_healthy}

  snowflakes:
@@ -455,8 +493,9 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: snowflakes
      FLUXER_SVC_MODE: router
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  snowflakes-shard:
    <<: *fluxer-service
@@ -470,8 +509,9 @@ services:
      FLUXER_SVC_NAME: snowflakes
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  users:
    <<: *fluxer-service
@@ -484,8 +524,9 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_MODE: router
      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-20}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  users-shard:
    <<: *fluxer-service
@@ -500,8 +541,9 @@ services:
      FLUXER_SVC_SHARD_ID: "0"
      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "20"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      postgres: {condition: service_healthy}

  gifs:
@@ -515,9 +557,10 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: router
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  gifs-shard:
    <<: *fluxer-service
@@ -531,9 +574,10 @@ services:
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  messages:
    <<: *fluxer-service
@@ -547,8 +591,9 @@ services:
      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: router
      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-20}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  messages-shard:
    <<: *fluxer-service
@@ -564,8 +609,9 @@ services:
      FLUXER_SVC_SHARD_ID: "0"
      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "20"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      postgres: {condition: service_healthy}

  unfurl:
@@ -578,8 +624,11 @@ services:
    environment:
      <<: *fluxer-env
      FLUXER_SVC_MODE: router
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  unfurl-shard:
    <<: *fluxer-service
@@ -592,8 +641,11 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  admin:
    <<: *fluxer-service
@@ -608,11 +660,18 @@ services:
      FLUXER_ADMIN_PORT: "8080"
      FLUXER_ADMIN_BASE_PATH: /admin
      FLUXER_API_ENDPOINT: http://api:8080
-      FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/admin
-      FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
-      FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
-      FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/admin/oauth2_callback
+      FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin
+      FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+      FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+      FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin/oauth2_callback
+    healthcheck:
+      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 60s
+      start_interval: 1s
    depends_on:
      api: {condition: service_healthy}

@@ -0,0 +1,4 @@
+services:
+  caddy:
+    ports: !override
+      - "${FLUXER_HTTP_PORT:-127.0.0.1:80}:80"