Mickey
81 lines
2.1 KiB
Markdown
81 lines
2.1 KiB
Markdown
# HTTPS Reverse Proxy
|
|
|
|
This directory hosts the single public HTTPS entry point for apps under `/opt/docker/apps`.
|
|
|
|
## Route config
|
|
|
|
Edit [config/proxy.yaml](/opt/docker/apps/proxy/config/proxy.yaml) and add routes like:
|
|
|
|
```yaml
|
|
server_name: mnmsoft.hopto.org
|
|
certificate_name: mnmsoft.hopto.org
|
|
|
|
routes:
|
|
- project_dir: /opt/docker/apps/turnir2024
|
|
path_suffix: odzaci-open-2026
|
|
port: 32834
|
|
upstream_scheme: https
|
|
```
|
|
|
|
Fields:
|
|
|
|
- `project_dir`: informational only, kept in the generated config and landing page.
|
|
- `path_suffix`: public path after the domain. `odzaci-open-2026` becomes `https://mnmsoft.hopto.org/odzaci-open-2026/`.
|
|
- `port`: port exposed on the Docker host by the target app.
|
|
- `upstream_scheme`: optional, defaults to `http`. Use `https` if the backend app still terminates TLS itself.
|
|
- `upstream_host`: optional, defaults to `host.docker.internal`.
|
|
|
|
## Start
|
|
|
|
```bash
|
|
./scripts/render.sh
|
|
docker compose up -d
|
|
```
|
|
|
|
After changing routes:
|
|
|
|
```bash
|
|
./scripts/render.sh
|
|
docker compose restart proxy
|
|
```
|
|
|
|
## TLS certificates
|
|
|
|
Issue a Let's Encrypt certificate after the proxy is reachable on public port `80`:
|
|
|
|
```bash
|
|
./scripts/certbot-init.sh mnmsoft.hopto.org you@example.com
|
|
```
|
|
|
|
Renew manually:
|
|
|
|
```bash
|
|
./scripts/certbot-renew.sh
|
|
```
|
|
|
|
Typical cron entry:
|
|
|
|
```cron
|
|
0 3 * * * cd /opt/docker/apps/proxy && ./scripts/certbot-renew.sh >/var/log/proxy-certbot-renew.log 2>&1
|
|
```
|
|
|
|
The proxy serves certificates from a stable path:
|
|
|
|
```text
|
|
./letsencrypt/live/current/fullchain.pem
|
|
./letsencrypt/live/current/privkey.pem
|
|
```
|
|
|
|
Certbot may create versioned lineages such as `mnmsoft.hopto.org-0001`; the helper scripts automatically repoint `live/current/` to the latest real lineage after issuance or renewal.
|
|
|
|
## Important behavior
|
|
|
|
This proxy strips the configured prefix before forwarding. Example:
|
|
|
|
- public request: `/odzaci-open-2026/api/matches`
|
|
- upstream request: `/api/matches`
|
|
|
|
It also sends `X-Forwarded-Prefix: /odzaci-open-2026`.
|
|
|
|
Apps that generate absolute URLs from `/` instead of respecting the forwarded prefix may still need app-level configuration changes.
|