HTTPS: two deployment variants (host-TLS / in-stack Caddy)#2
Merged
Conversation
Two self-contained compose variants sharing one .env (variant-specific vars are
grouped in commented sections), each with a full description + usage in its header:
- docker-compose.prod.yml (Variant 1): TLS on a host/NAS proxy. API serves HTTP
on $API_BIND (default :8000); Django trusts X-Forwarded-Proto. 2 containers.
- docker-compose.tls.yml (Variant 2): HTTPS inside the stack via Caddy. API is
internal; Caddy publishes 80/443, obtains + auto-renews the cert. Cert mode via
ACME_EMAIL (empty = self-signed CA, e.g. localhost; email = Let's Encrypt).
PROXY_HTTP/PROXY_HTTPS bind a specific host IP when :443 is taken.
settings.py: SECURE_PROXY_SSL_HEADER; DOMAIN auto-adds to ALLOWED_HOSTS + CSRF.
docker/proxy/Caddyfile: hostname-routed, tls {$TLS_ARG}, reverse_proxy to api.
Verified: tests + ruff pass; Variant 2 serves https://localhost (self-signed),
HTTP->HTTPS redirect, API endpoints over TLS; both configs valid.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Per review: the two compose files are documented as deployment scenarios (your own proxy handles TLS, vs this stack handles TLS with auto-renewal), not as test/dev variants. Removed ACME jargon (HTTP-01 / DNS-01) from the file headers and .env — those are meaningless to a deployer. Each variant's header and the README now show the exact address to enter in the mobile app (the API server URL, e.g. https://api.robozor.cz). Self-signed localhost kept only as a one-line local-check note.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dvě varianty nasazení, jeden
.envKaždá varianta je samostatný compose (jeden
-f), s popisem a způsobem použití v hlavičce souboru. Proměnné specifické pro variantu jsou v.env.examplev komentovaných sekcích.Varianta 1 — TLS na host/NAS proxy (
docker-compose.prod.yml)API_BIND, default:8000); TLS + certy řeší externí/host proxy.X-Forwarded-Proto. 2 kontejnery (DB, API).docker compose -f docker-compose.prod.yml up -dVarianta 2 — HTTPS ve stacku přes Caddy (
docker-compose.tls.yml)ACME_EMAIL: prázdné → self-signed (např.DOMAIN=localhost); e-mail → Let's Encrypt.PROXY_HTTP/PROXY_HTTPSumí bind na konkrétní IP, když je:443obsazené.DOMAIN=localhost docker compose -f docker-compose.tls.yml up -dBackend
SECURE_PROXY_SSL_HEADER(důvěra proxy);DOMAINse automaticky propíše doALLOWED_HOSTS+ CSRF.docker/proxy/Caddyfile— routování podle hostname,reverse_proxyna API.Ověřeno
Testy + ruff zelené. Varianta 2 lokálně:
https://localhost/healthzOK (self-signed), HTTP→HTTPS redirect 308, API endpointy přes TLS; oba configy validní.Mimo rozsah
Reálný Let's Encrypt cert (Forpsi nemá Caddy DNS plugin → buď HTTP-01 přes routing, nebo acme-dns; řeší se zvlášť).
🤖 Generated with Claude Code