mirror of
https://github.com/HeyPuter/puter.git
synced 2026-08-23 14:36:44 +00:00
Sauhbagya PrasadandDaniel Salazar
7cf3e03433
* Replace nginx with Caddy * updated caddy location * seprate logic for local and with domain caddy setup * updated install * updated install scripts new ps1 script with caddy, and removed instances of nginx * fix Caddy Host routing, restore TLS/SELinux/healthcheck, update docs --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>
74 lines
3.0 KiB
Caddyfile
74 lines
3.0 KiB
Caddyfile
# Reverse proxy in front of Puter — mirrors what the prod ALB does:
|
|
# accepts every Host header, forwards to the Puter container, and lets
|
|
# the Puter app handle subdomain-based routing internally (api.*,
|
|
# site.*, app.*, dev.*, plus the per-user subdomains under those).
|
|
#
|
|
# To enable TLS:
|
|
# 1. Drop a wildcard fullchain.pem + privkey.pem into ./puter/tls/
|
|
# (see "Step 3 — TLS" in doc/self-hosting.md).
|
|
# 2. Uncomment the `:443` block at the bottom of this file, and swap the
|
|
# `:80` block for the redirect shown alongside it.
|
|
# 3. Uncomment the `443:443` port mapping under the `caddy` service in
|
|
# docker-compose.yml, and HTTPS_PORT in .env.
|
|
# 4. Set `"protocol": "https"` and `"pub_port": 443` in config.json.
|
|
{
|
|
# Certs are supplied by the operator, not issued by Caddy. Puter serves
|
|
# per-user sites and apps on dynamic subdomains (<name>.site.<domain>,
|
|
# <name>.app.<domain>) — only a DNS-01 wildcard cert covers those, and
|
|
# DNS-01 needs a provider plugin that isn't in the stock caddy image.
|
|
# `off` stops Caddy attempting ACME on boot (it would fail and leave the
|
|
# site unreachable) and stops it inventing its own http→https redirects.
|
|
auto_https off
|
|
}
|
|
|
|
# Shared handling, imported by the HTTP and HTTPS site blocks below so the
|
|
# two can't drift apart.
|
|
(puter_routes) {
|
|
# Rough size cap that mirrors prod ALB defaults; tune for your uploads.
|
|
# Puter chunks large uploads, so 1 GiB per request is plenty.
|
|
request_body {
|
|
max_size 1024MiB
|
|
}
|
|
|
|
# RustFS — see the `s3` service in docker-compose.yml. Browsers PUT/GET
|
|
# here for presigned-URL uploads / downloads. Matched on the `s3.`
|
|
# subdomain of whatever the install domain is, so signature verification
|
|
# works (Caddy preserves the original Host end-to-end) and HTTPS stays
|
|
# clean — no mixed content from a port-9000 host publish.
|
|
@s3 header_regexp Host ^s3\.
|
|
handle @s3 {
|
|
reverse_proxy s3:9000
|
|
}
|
|
|
|
# Everything else, on every Host, goes to Puter — which routes on that
|
|
# Host internally. Caddy forwards it unchanged and adds X-Forwarded-For
|
|
# / -Proto / -Host, which is what `trust_proxy` in config.json counts.
|
|
handle {
|
|
reverse_proxy puter:4100 {
|
|
# Stream responses through unbuffered — Puter uses SSE and
|
|
# socket.io. WebSocket upgrades need no config of their own;
|
|
# Caddy proxies them by default.
|
|
flush_interval -1
|
|
}
|
|
}
|
|
}
|
|
|
|
# ── HTTP (port 80) ─────────────────────────────────────────────────────
|
|
# A site address with no hostname is the catch-all: it answers for every
|
|
# Host, which is what Puter's subdomain routing requires.
|
|
:80 {
|
|
import puter_routes
|
|
}
|
|
|
|
# ── HTTPS (port 443) — uncomment after dropping certs in ./puter/tls/ ──
|
|
# Replace the `:80` block above with a redirect to force HTTPS everywhere:
|
|
#
|
|
# :80 {
|
|
# redir https://{host}{uri} permanent
|
|
# }
|
|
#
|
|
# :443 {
|
|
# tls /etc/caddy/tls/fullchain.pem /etc/caddy/tls/privkey.pem
|
|
# import puter_routes
|
|
# }
|