Initial commit

2026-07-03 19:06:49 +02:00
commit 32056c356f
16 changed files with 1067 additions and 0 deletions
@@ -0,0 +1,80 @@
+# HTTPS Reverse Proxy
+
+This directory hosts the single public HTTPS entry point for apps under `/opt/docker/apps`.
+
+## Route config
+
+Edit [config/proxy.yaml](/opt/docker/apps/proxy/config/proxy.yaml) and add routes like:
+
+```yaml
+server_name: mnmsoft.hopto.org
+certificate_name: mnmsoft.hopto.org
+
+routes:
+  - project_dir: /opt/docker/apps/turnir2024
+    path_suffix: odzaci-open-2026
+    port: 32834
+    upstream_scheme: https
+```
+
+Fields:
+
+- `project_dir`: informational only, kept in the generated config and landing page.
+- `path_suffix`: public path after the domain. `odzaci-open-2026` becomes `https://mnmsoft.hopto.org/odzaci-open-2026/`.
+- `port`: port exposed on the Docker host by the target app.
+- `upstream_scheme`: optional, defaults to `http`. Use `https` if the backend app still terminates TLS itself.
+- `upstream_host`: optional, defaults to `host.docker.internal`.
+
+## Start
+
+```bash
+./scripts/render.sh
+docker compose up -d
+```
+
+After changing routes:
+
+```bash
+./scripts/render.sh
+docker compose restart proxy
+```
+
+## TLS certificates
+
+Issue a Let's Encrypt certificate after the proxy is reachable on public port `80`:
+
+```bash
+./scripts/certbot-init.sh mnmsoft.hopto.org you@example.com
+```
+
+Renew manually:
+
+```bash
+./scripts/certbot-renew.sh
+```
+
+Typical cron entry:
+
+```cron
+0 3 * * * cd /opt/docker/apps/proxy && ./scripts/certbot-renew.sh >/var/log/proxy-certbot-renew.log 2>&1
+```
+
+The proxy serves certificates from a stable path:
+
+```text
+./letsencrypt/live/current/fullchain.pem
+./letsencrypt/live/current/privkey.pem
+```
+
+Certbot may create versioned lineages such as `mnmsoft.hopto.org-0001`; the helper scripts automatically repoint `live/current/` to the latest real lineage after issuance or renewal.
+
+## Important behavior
+
+This proxy strips the configured prefix before forwarding. Example:
+
+- public request: `/odzaci-open-2026/api/matches`
+- upstream request: `/api/matches`
+
+It also sends `X-Forwarded-Prefix: /odzaci-open-2026`.
+
+Apps that generate absolute URLs from `/` instead of respecting the forwarded prefix may still need app-level configuration changes.