From 961fa1f007b5d7ecd49739463c6aa3185e2eab7a Mon Sep 17 00:00:00 2001 From: Hampus Date: Tue, 1 Sep 2026 20:47:20 +0200 Subject: [PATCH] fix(self-hosting): correct compose probes and origins (#2330) --- deploy/self-hosting/.env.example | 48 ++++++++ deploy/self-hosting/docker-compose.yml | 153 +++++++++++++++++-------- deploy/self-hosting/tunnel.compose.yml | 4 + 3 files changed, 158 insertions(+), 47 deletions(-) create mode 100644 deploy/self-hosting/tunnel.compose.yml diff --git a/deploy/self-hosting/.env.example b/deploy/self-hosting/.env.example index febd7bac3..403332646 100644 --- a/deploy/self-hosting/.env.example +++ b/deploy/self-hosting/.env.example @@ -1,8 +1,41 @@ FLUXER_DOMAIN=chat.example.com FLUXER_PUBLIC_SCHEME=https FLUXER_PUBLIC_PORT=443 +FLUXER_PUBLIC_ORIGIN=${FLUXER_PUBLIC_SCHEME}://${FLUXER_DOMAIN} FLUXER_CADDY_SITE_ADDRESS=chat.example.com +# FLUXER_PUBLIC_ORIGIN is the origin browsers see. It must carry the port +# whenever FLUXER_PUBLIC_PORT is not the default for its scheme, because an +# origin written with a default port never matches a browser Origin header. +# Serving on any other port means setting all three, plus the published port +# below, and pointing FLUXER_CADDY_SITE_ADDRESS at the same scheme and host. +# Compose expands this file from top to bottom, so FLUXER_PUBLIC_ORIGIN has to +# stay below the two values it reads. Above them it silently expands to a bare +# host with a trailing colon. +#FLUXER_PUBLIC_SCHEME=http +#FLUXER_PUBLIC_PORT=19080 +#FLUXER_PUBLIC_ORIGIN=${FLUXER_PUBLIC_SCHEME}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT} +#FLUXER_HTTP_PORT=19080 + +# Ports Caddy publishes on the host. Caddy still listens on 80 and 443 inside +# the container, so change only these when something else already owns the +# standard ports or another proxy sits in front. Both take an optional bind +# address in front of the port, and 127.0.0.1 keeps the publish off every +# public interface. FLUXER_HTTPS_PORT moves the TCP and the UDP publish +# together, because HTTP/3 needs both on the same port. +#FLUXER_HTTP_PORT=80 +#FLUXER_HTTPS_PORT=443 +#FLUXER_HTTP_PORT=127.0.0.1:80 +#FLUXER_HTTPS_PORT=127.0.0.1:443 + +# A tunnel or another proxy in front of the stack needs no HTTPS publish at all. +# tunnel.compose.yml ships beside this file and replaces Caddy's published ports +# with a single loopback HTTP publish, so nothing binds 443. FLUXER_HTTP_PORT +# still moves that one publish. Set the line below and plain docker compose +# commands pick the file up, or add it to your own -f flags if you pass any. The +# file uses the !override tag, which needs Compose 2.24.4 or newer. +#COMPOSE_FILE=docker-compose.yml:tunnel.compose.yml + FLUXER_REGISTRY_OWNER=fluxerapp FLUXER_REGISTRY=ghcr.io/${FLUXER_REGISTRY_OWNER} FLUXER_IMAGE_TAG=v1 @@ -30,6 +63,7 @@ FLUXER_VAPID_EMAIL=admin@example.com #FLUXER_PASSKEY_RP_ID=chat.example.com #FLUXER_PASSKEY_RP_NAME=Fluxer #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=https://chat.example.com +#FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=http://chat.example.com:19080 # Extra Content-Security-Policy sources, appended to the built-in ones. Set these # only when a browser must reach an origin the defaults do not cover, such as a @@ -49,6 +83,20 @@ FLUXER_VAPID_EMAIL=admin@example.com LIVEKIT_API_KEY=fluxer LIVEKIT_API_SECRET=CHANGE_ME +# Ports LiveKit publishes on the host for voice and video media. They take the +# same optional bind address as the Caddy ports above. This media does not pass +# through Caddy or through a tunnel, so it needs these ports reachable from +# clients. LiveKit advertises the port numbers from livekit.yaml, so publishing +# them on different host ports means changing that file too. +#FLUXER_LIVEKIT_TCP_PORT=7881 +#FLUXER_LIVEKIT_UDP_PORT=7882 + +# The voice server URL clients connect to. It defaults to FLUXER_PUBLIC_ORIGIN +# plus /livekit, which the bundled Caddy proxies to the LiveKit container. Set +# it only when LiveKit lives on its own host, and add that origin to +# FLUXER_CSP_EXTRA_CONNECT_SRC when you do. +#FLUXER_LIVEKIT_URL=wss://voice.example.com + FLUXER_KLIPY_API_KEY= FLUXER_EMAIL_ENABLED=false diff --git a/deploy/self-hosting/docker-compose.yml b/deploy/self-hosting/docker-compose.yml index f3f90c92b..219b15bc3 100644 --- a/deploy/self-hosting/docker-compose.yml +++ b/deploy/self-hosting/docker-compose.yml @@ -55,6 +55,7 @@ x-fluxer-env: &fluxer-env FLUXER_LIVEKIT_INTERNAL_URL: http://livekit:7880 FLUXER_LIVEKIT_WEBHOOK_URL: http://api:8080/webhooks/livekit FLUXER_LIVEKIT_DEFAULT_REGION: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}' + FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/livekit} FLUXER_KLIPY_API_KEY: ${FLUXER_KLIPY_API_KEY:-} @@ -85,7 +86,7 @@ x-fluxer-env: &fluxer-env FLUXER_VAPID_EMAIL: ${FLUXER_VAPID_EMAIL:-admin@${FLUXER_DOMAIN}} FLUXER_PASSKEY_RP_ID: ${FLUXER_PASSKEY_RP_ID:-${FLUXER_DOMAIN}} FLUXER_PASSKEY_RP_NAME: ${FLUXER_PASSKEY_RP_NAME:-Fluxer} - FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}} + FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}} FLUXER_GATEWAY_RPC_AUTH_TOKEN: ${FLUXER_GATEWAY_RPC_AUTH_TOKEN:?set FLUXER_GATEWAY_RPC_AUTH_TOKEN in .env} FLUXER_MEDIA_PROXY_SECRET_KEY: ${FLUXER_MEDIA_PROXY_SECRET_KEY:?set FLUXER_MEDIA_PROXY_SECRET_KEY in .env} FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64:?set FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 in .env} @@ -95,15 +96,23 @@ x-fluxer-env: &fluxer-env FLUXER_INTERNAL_API_ENDPOINT: http://api:8080 FLUXER_INTERNAL_GATEWAY_ENDPOINT: http://gateway:8080 FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080 - FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN} + FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}} FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080 - FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media - FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media + FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media + FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media x-fluxer-service: &fluxer-service restart: unless-stopped networks: [fluxer] +x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck + test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8090 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"] + interval: 10s + timeout: 5s + retries: 30 + start_period: 60s + start_interval: 1s + services: caddy: image: caddy:2.10-alpine @@ -114,15 +123,20 @@ services: restart: unless-stopped networks: [fluxer] ports: - - "80:80" - - "443:443" - - "443:443/udp" + - "${FLUXER_HTTP_PORT:-80}:80" + - "${FLUXER_HTTPS_PORT:-443}:443" + - "${FLUXER_HTTPS_PORT:-443}:443/udp" environment: FLUXER_CADDY_SITE_ADDRESS: ${FLUXER_CADDY_SITE_ADDRESS:?set FLUXER_CADDY_SITE_ADDRESS in .env} volumes: - ./Caddyfile:/etc/caddy/Caddyfile:ro - caddy-data:/data - caddy-config:/config + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"] + interval: 10s + timeout: 5s + retries: 10 depends_on: api: {condition: service_started} gateway: {condition: service_healthy} @@ -207,6 +221,11 @@ services: command: ["-js", "-sd", "/data", "-m", "8222"] volumes: - nats-data:/data + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8222/healthz"] + interval: 10s + timeout: 5s + retries: 10 meilisearch: image: getmeili/meilisearch:v1.12 @@ -223,6 +242,11 @@ services: MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env} volumes: - meilisearch-data:/meili_data + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7700/health"] + interval: 10s + timeout: 5s + retries: 10 seaweedfs: image: chrislusf/seaweedfs:4.34 @@ -235,6 +259,11 @@ services: command: ["server", "-s3", "-dir=/data"] volumes: - seaweedfs-data:/data + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8333/"] + interval: 10s + timeout: 5s + retries: 20 seaweedfs-init: image: chrislusf/seaweedfs:4.34 @@ -243,7 +272,8 @@ services: limits: memory: ${FLUXER_SEAWEEDFS_INIT_MEMORY_LIMIT:-128mb} networks: [fluxer] - depends_on: [seaweedfs] + depends_on: + seaweedfs: {condition: service_healthy} restart: "no" entrypoint: - /bin/sh @@ -289,6 +319,11 @@ services: ports: - "${FLUXER_LIVEKIT_TCP_PORT:-7881}:7881" - "${FLUXER_LIVEKIT_UDP_PORT:-7882}:7882/udp" + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7880/"] + interval: 10s + timeout: 5s + retries: 10 api: <<: *fluxer-service @@ -315,17 +350,17 @@ services: depends_on: postgres: {condition: service_healthy} valkey: {condition: service_healthy} - nats: {condition: service_started} - meilisearch: {condition: service_started} + nats: {condition: service_healthy} + meilisearch: {condition: service_healthy} seaweedfs-init: {condition: service_completed_successfully} - gifs: {condition: service_started} - gifs-shard: {condition: service_started} - snowflakes: {condition: service_started} - snowflakes-shard: {condition: service_started} - messages: {condition: service_started} - messages-shard: {condition: service_started} - users: {condition: service_started} - users-shard: {condition: service_started} + gifs: {condition: service_healthy} + gifs-shard: {condition: service_healthy} + snowflakes: {condition: service_healthy} + snowflakes-shard: {condition: service_healthy} + messages: {condition: service_healthy} + messages-shard: {condition: service_healthy} + users: {condition: service_healthy} + users-shard: {condition: service_healthy} worker: <<: *fluxer-service @@ -355,11 +390,11 @@ services: depends_on: postgres: {condition: service_healthy} valkey: {condition: service_healthy} - nats: {condition: service_started} + nats: {condition: service_healthy} seaweedfs-init: {condition: service_completed_successfully} - snowflakes-shard: {condition: service_started} - messages-shard: {condition: service_started} - users-shard: {condition: service_started} + snowflakes-shard: {condition: service_healthy} + messages-shard: {condition: service_healthy} + users-shard: {condition: service_healthy} gateway: <<: *fluxer-service @@ -373,8 +408,8 @@ services: environment: <<: *fluxer-env FLUXER_GATEWAY_PORT: "8080" - FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media - FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN} + FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media + FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}} FLUXER_GATEWAY_LOGGER_LEVEL: info healthcheck: test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/_health/ready"] @@ -383,7 +418,7 @@ services: retries: 30 start_period: 90s depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} valkey: {condition: service_healthy} media-proxy: @@ -399,11 +434,9 @@ services: FLUXER_MEDIA_PROXY_PORT: "8080" FLUXER_MEDIA_PROXY_MODE: upload FLUXER_MEDIA_PROXY_STORAGE_BACKEND: s3 - healthcheck: - disable: true depends_on: seaweedfs-init: {condition: service_completed_successfully} - nats: {condition: service_started} + nats: {condition: service_healthy} static-proxy: <<: *fluxer-service @@ -412,6 +445,11 @@ services: resources: limits: memory: ${FLUXER_STATIC_PROXY_MEMORY_LIMIT:-256mb} + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/avatars/0.png"] + interval: 10s + timeout: 5s + retries: 10 app-proxy: <<: *fluxer-service @@ -426,7 +464,7 @@ services: FLUXER_APP_PROXY_PORT: "8080" DISCOVERY_UPSTREAM_URL: http://caddy:8088/api/.well-known/fluxer PUBLIC_BOOTSTRAP_API_ENDPOINT: /api - PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/api + PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api FLUXER_CSP_EXTRA_DEFAULT_SRC: ${FLUXER_CSP_EXTRA_DEFAULT_SRC:-} FLUXER_CSP_EXTRA_CONNECT_SRC: ${FLUXER_CSP_EXTRA_CONNECT_SRC:-} FLUXER_CSP_EXTRA_IMG_SRC: ${FLUXER_CSP_EXTRA_IMG_SRC:-} @@ -441,7 +479,7 @@ services: FLUXER_POSTGRES_MAX_CONNECTIONS: "5" depends_on: api: {condition: service_healthy} - caddy: {condition: service_started} + caddy: {condition: service_healthy} postgres: {condition: service_healthy} snowflakes: @@ -455,8 +493,9 @@ services: <<: *fluxer-env FLUXER_SVC_NAME: snowflakes FLUXER_SVC_MODE: router + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} snowflakes-shard: <<: *fluxer-service @@ -470,8 +509,9 @@ services: FLUXER_SVC_NAME: snowflakes FLUXER_SVC_MODE: shard FLUXER_SVC_SHARD_ID: "0" + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} users: <<: *fluxer-service @@ -484,8 +524,9 @@ services: <<: *fluxer-env FLUXER_SVC_MODE: router FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-20}" + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} users-shard: <<: *fluxer-service @@ -500,8 +541,9 @@ services: FLUXER_SVC_SHARD_ID: "0" FLUXER_POSTGRES_MAX_CONNECTIONS: "20" FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "20" + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} postgres: {condition: service_healthy} gifs: @@ -515,9 +557,10 @@ services: <<: *fluxer-env FLUXER_SVC_NAME: gifs FLUXER_SVC_MODE: router - FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media + FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} gifs-shard: <<: *fluxer-service @@ -531,9 +574,10 @@ services: FLUXER_SVC_NAME: gifs FLUXER_SVC_MODE: shard FLUXER_SVC_SHARD_ID: "0" - FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media + FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} messages: <<: *fluxer-service @@ -547,8 +591,9 @@ services: FLUXER_SVC_NAME: messages FLUXER_SVC_MODE: router FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-20}" + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} messages-shard: <<: *fluxer-service @@ -564,8 +609,9 @@ services: FLUXER_SVC_SHARD_ID: "0" FLUXER_POSTGRES_MAX_CONNECTIONS: "20" FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "20" + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} postgres: {condition: service_healthy} unfurl: @@ -578,8 +624,11 @@ services: environment: <<: *fluxer-env FLUXER_SVC_MODE: router + FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media + FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}} + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} unfurl-shard: <<: *fluxer-service @@ -592,8 +641,11 @@ services: <<: *fluxer-env FLUXER_SVC_MODE: shard FLUXER_SVC_SHARD_ID: "0" + FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media + FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}} + healthcheck: *fluxer-svc-healthcheck depends_on: - nats: {condition: service_started} + nats: {condition: service_healthy} admin: <<: *fluxer-service @@ -608,11 +660,18 @@ services: FLUXER_ADMIN_PORT: "8080" FLUXER_ADMIN_BASE_PATH: /admin FLUXER_API_ENDPOINT: http://api:8080 - FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/admin - FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN} - FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media - FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN} - FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/admin/oauth2_callback + FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin + FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}} + FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media + FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}} + FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin/oauth2_callback + healthcheck: + test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"] + interval: 10s + timeout: 5s + retries: 30 + start_period: 60s + start_interval: 1s depends_on: api: {condition: service_healthy} diff --git a/deploy/self-hosting/tunnel.compose.yml b/deploy/self-hosting/tunnel.compose.yml new file mode 100644 index 000000000..66a6f7882 --- /dev/null +++ b/deploy/self-hosting/tunnel.compose.yml @@ -0,0 +1,4 @@ +services: + caddy: + ports: !override + - "${FLUXER_HTTP_PORT:-127.0.0.1:80}:80"