svelte-mud/DOCKER-README.md

Docker deployment

The Compose deployment uses two containers made from the same image:

• svelte-mud-app runs the adapter-node SvelteKit build on port 3000.
• svelte-mud-proxy runs the WebSocket-to-Telnet proxy on port 3001.

Neither port is published to the host. Both services join the external revproxy network for access by Caddy.

Deploy

1. Change mud.iamtalon.me in docker-compose.yml and Caddyfile to the actual public hostname.

2. Create the proxy network if it does not already exist:

   docker network create revproxy
   

3. Build and start both services:

   docker compose up --build -d
   

4. Inspect health and logs:

   docker compose ps
   docker compose logs -f
   

Stop the deployment with docker compose down.

Reverse proxy

The included Caddyfile sends /mud-ws to svelte-mud-proxy:3001 and other requests to svelte-mud-app:3000. It also installs a restrictive content security policy and related browser security headers.

TRUST_PROXY=1 must only be used when clients cannot reach the proxy container directly and the forwarding proxy overwrites X-Forwarded-For. Otherwise remove it so connection quotas use the actual socket address.

ALLOWED_ORIGINS is an exact, comma-separated allowlist. For example:

ALLOWED_ORIGINS: https://mud.example.com

Do not publish port 3001 publicly. Origin checks are a browser boundary, not an authentication mechanism.

Updating

docker compose build --pull
docker compose up -d

The containers run as an unprivileged user and include independent health checks for the web app and proxy.