88b7f55db4
Full production-ready docker-compose stack (db, kong, auth, rest, realtime, storage, imgproxy, meta, functions, studio) targeting api.caterium.ru, plus bootstrap script for a fresh Cloud Server, Caddy reverse-proxy config (HTTPS, WebSocket, upload limits), and dump/restore/verify/storage-sync scripts for moving off the managed Supabase project (cksuehzcimitsxmeloes). Does not touch public/ or any live runtime behavior — frontend cutover is documented separately in frontend-cutover.md and only applied after Etap 8 verification. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
54 lines
1.4 KiB
Caddyfile
54 lines
1.4 KiB
Caddyfile
{
|
|
email admin@caterium.ru
|
|
}
|
|
|
|
api.caterium.ru {
|
|
encode gzip zstd
|
|
|
|
# Storage uploads (photos, docs) — match FILE_SIZE_LIMIT in .env (50 MB default).
|
|
request_body {
|
|
max_size 50MB
|
|
}
|
|
|
|
# WebSocket upgrade for Realtime (Kong proxies to the realtime service).
|
|
@websockets {
|
|
header Connection *Upgrade*
|
|
header Upgrade websocket
|
|
}
|
|
reverse_proxy @websockets 127.0.0.1:8000
|
|
|
|
reverse_proxy 127.0.0.1:8000 {
|
|
header_up Host {host}
|
|
header_up X-Real-IP {remote_host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
flush_interval -1
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
}
|
|
|
|
log {
|
|
output file /var/log/caddy/api.caterium.ru.log {
|
|
roll_size 50mb
|
|
roll_keep 5
|
|
}
|
|
}
|
|
}
|
|
|
|
# Supabase Studio (admin dashboard) — not part of the public API surface.
|
|
# Kept on a separate host, gated by HTTP basic auth (DASHBOARD_USERNAME/PASSWORD from .env,
|
|
# hash with `caddy hash-password`), and NOT referenced by the Caterium frontend at all.
|
|
# Point a DNS record at this host only if/when you want browser access; otherwise reach
|
|
# Studio via `ssh -L 3000:127.0.0.1:3000 timeweb-caterium-vps` and open http://127.0.0.1:3000.
|
|
studio.caterium.ru {
|
|
basic_auth {
|
|
# Replace with: caddy hash-password --plaintext '<DASHBOARD_PASSWORD>'
|
|
{$DASHBOARD_USERNAME} {$DASHBOARD_PASSWORD_HASH}
|
|
}
|
|
reverse_proxy 127.0.0.1:3000
|
|
}
|