sam/ai-resume
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deploy: publish on the LAN address so Caddy on .35 can reach it

Browse Source 
127.0.0.1:8096 is unreachable from .35, which is where Caddy runs. Every other
service on .13 is published this way (8095, 8092, 3909, 4200) and proxied by the
same Caddy. Port is LAN-only; Caddy remains the sole public listener.
This commit is contained in:
Sam Rolfe
2026-10-26 22:38:54 +11:00
committed by Sam Rolfe
parent df864cc29e
commit f39f560c7f
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
deploy/compose.yml
View File

@@ -30,11 +30,13 @@ services:
restart: unless-stopped restart: unless-stopped
mem_limit: 120m mem_limit: 120m
memswap_limit: 120m memswap_limit: 120m
# The app listens on 0.0.0.0 inside the container namespace; the host-side # Published on this host's LAN address, not loopback. Caddy lives on .35 and
# binding is loopback, so nothing is reachable from the LAN except through # proxies to 192.168.20.13:8096, exactly as it does for offsite (:8095),
# docker-proxy on 127.0.0.1:8096 — which is what Caddy proxies to. # photo-filter (:8092), garage-ui (:3909) and prefect (:4200). The port is
# reachable inside the house only; Caddy on .35 remains the sole public
# listener, which is the intent of AGENTS.md section 4.
ports: ports:
- "127.0.0.1:8096:8096" - "192.168.20.13:8096:8096"
read_only: true read_only: true
security_opt: security_opt:
- no-new-privileges:true - no-new-privileges:true