# central-proxy

The shared edge reverse proxy for the DigitalOcean droplet (`174.138.36.232`).
A single **Caddy** container terminates TLS for every site on the box and routes
each hostname to the right upstream container. It is the only thing published on
ports 80 and 443; all the application stacks (bigode, nazareonline, ...) sit
behind it on the external `proxy_net` Docker network and speak plain HTTP to it.

Caddy manages Let's Encrypt certificates automatically - it obtains and renews a
cert for each hostname listed in the `Caddyfile` on first request. Issued certs
and ACME account keys persist in the `caddy_data` Docker volume (mounted at
`/data`), not in this repo.

## Layout

```
compose.yaml   the Caddy service: publishes 80/443, joins proxy_net,
               bind-mounts the Caddyfile, persists certs in caddy_data
Caddyfile      one site block per app; each reverse_proxies to a container
               reachable by name on proxy_net
```

## Prerequisites

- The external network exists: `docker network create proxy_net`.
- Each upstream stack attaches its public-facing container to `proxy_net`, so
  Caddy can reach it by container name (e.g. `nazareonline-web-1:80`).
- DNS A records for every hostname in the `Caddyfile` point at the droplet.

## Adding a site

Add a block to the `Caddyfile` naming the hostname(s) and the upstream:

```
www.example.com, example.com {
    reverse_proxy example-web-1:80
}
```

The upstream container must be on `proxy_net`. Caddy forwards the original `Host`
and sets `X-Forwarded-Proto: https`, so upstreams behind it can rebuild HTTPS
URLs and do their own host canonicalisation.

Then reload without downtime (does not disturb the other sites):

```sh
docker exec central-proxy-caddy-1 caddy reload --config /etc/caddy/Caddyfile
```

Validate a change before reloading:

```sh
docker run --rm -v "$PWD/Caddyfile":/etc/caddy/Caddyfile:ro caddy:2-alpine \
  caddy validate --config /etc/caddy/Caddyfile
```

## Deploy

The compose stack lives at `/home/waldson/central-proxy` on the droplet. To
apply a change, copy the edited `Caddyfile` up and reload:

```sh
scp -i ~/.ssh/deploy_key ./Caddyfile waldson@174.138.36.232:/home/waldson/central-proxy/Caddyfile
ssh -i ~/.ssh/deploy_key waldson@174.138.36.232 \
  'docker exec central-proxy-caddy-1 caddy reload --config /etc/caddy/Caddyfile'
```

Bring the proxy up (or recreate it after a compose change) from that directory:

```sh
docker compose up -d
```

## Notes

- `letsencrypt/acme.json` is leftover state from an earlier Traefik-based proxy
  and is not used by Caddy. It is git-ignored (it contains private keys); it can
  be deleted from the droplet once you are sure nothing references it.
- Never `docker volume rm caddy_data` - that discards every issued certificate
  and forces re-issuance, which can hit Let's Encrypt rate limits.