5fc136dc49
The password now lives in CADPRox_Secrets (mode 600, git-ignored) and is
mounted read-only into the container, rather than being read from the
compose file. Two reasons:
- the password contains '#', which YAML reads as the start of a comment,
so putting it in docker-compose.yml was never going to work;
- anything in the compose file is visible in `docker compose config` and
`docker inspect`, and would be easy to commit by accident.
read_secrets_file() accepts either a bare password on one line, which is
the common case, or a key=value file so the same file can hold more than
one secret later. A bare password containing '=' is not mangled, because
the key/value parse only wins when it recognises one of its own keys.
Also detect a bind mount whose source is missing. Docker creates a
directory in that case, which would otherwise fail confusingly and
quietly leave the app with no password.
The port stays CADPROX_PORT in the compose file and is deliberately not
added to ports:. Publishing a port needs bridge networking, which cannot
reach Caddy's admin API on 127.0.0.1:2019, and Docker discards a ports:
entry under host mode with only a warning - so it would read as a mapping
that is not there. Documented in the README instead.
50 lines
2.2 KiB
YAML
50 lines
2.2 KiB
YAML
# cadprox - web UI for the Caddy reverse proxy configuration
|
|
#
|
|
# network_mode: host is required, not stylistic. The Caddy admin API listens on
|
|
# 127.0.0.1:2019 on the host loopback and Caddy itself is in host mode, so this
|
|
# is the only way cadprox can reach it to hot-reload without restarting Caddy.
|
|
#
|
|
# The Caddyfile is mounted read-write because cadprox is the writer. Caddy keeps
|
|
# its own read-only mount, so a cadprox edit does not disturb the running
|
|
# container until the admin API accepts the new config.
|
|
|
|
services:
|
|
cadprox:
|
|
build: .
|
|
image: cadprox:1.0
|
|
container_name: cadprox
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
|
|
volumes:
|
|
# The managed Caddyfile. Read-write: cadprox writes it, Caddy reads it.
|
|
- /home/bdm/caddy:/caddy
|
|
# Audit log and runtime state. The generated admin credential is not
|
|
# written here any more, because the password now comes from the file
|
|
# below; this directory is kept for the audit log and for the fallback
|
|
# path if CADPROX_ADMIN_PASSWORD_FILE is ever removed.
|
|
- ./data:/data
|
|
# The admin password, kept out of this file so it never appears in
|
|
# `docker inspect` output or in version control. Read-only.
|
|
- ./CADPRox_Secrets:/run/secrets/cadprox-admin:ro
|
|
|
|
environment:
|
|
CADPROX_CADDYFILE: /caddy/Caddyfile
|
|
CADPROX_CADDY_ADMIN: http://127.0.0.1:2019
|
|
CADPROX_CADDY_BIN: caddy
|
|
CADPROX_DATA: /data
|
|
# The UI port. cadprox listens on the host network, so this binds 0.0.0.0
|
|
# of the host directly. It is set here explicitly so the value is
|
|
# visible in `docker compose config`.
|
|
#
|
|
# This deliberately does NOT appear in the PORTS column of `docker ps`:
|
|
# publishing a port requires bridge networking, and bridge networking
|
|
# cannot reach Caddy's admin API on 127.0.0.1:2019. Docker also discards
|
|
# a "ports:" entry under host mode with only a warning, so adding one
|
|
# would look like a mapping that is not there. The port is plain HTTP on
|
|
# the LAN - do not forward it to the internet.
|
|
CADPROX_PORT: "8090"
|
|
CADPROX_ADMIN_USER: admin
|
|
# Read from CADPRox_Secrets, mounted above at /run/secrets/cadprox-admin.
|
|
CADPROX_ADMIN_PASSWORD_FILE: /run/secrets/cadprox-admin
|