56 lines
1.6 KiB
Markdown
56 lines
1.6 KiB
Markdown
# Docker deployment
|
|
|
|
The Compose deployment uses two containers made from the same image:
|
|
|
|
- `svelte-mud-app` runs the adapter-node SvelteKit build on port 3000.
|
|
- `svelte-mud-proxy` runs the WebSocket-to-Telnet proxy on port 3001.
|
|
|
|
Neither port is published to the host. Both services join the external `revproxy` network for access by Caddy.
|
|
|
|
## Deploy
|
|
|
|
1. Change `mud.iamtalon.me` in `docker-compose.yml` and `Caddyfile` to the actual public hostname.
|
|
2. Create the proxy network if it does not already exist:
|
|
|
|
```bash
|
|
docker network create revproxy
|
|
```
|
|
|
|
3. Build and start both services:
|
|
|
|
```bash
|
|
docker compose up --build -d
|
|
```
|
|
|
|
4. Inspect health and logs:
|
|
|
|
```bash
|
|
docker compose ps
|
|
docker compose logs -f
|
|
```
|
|
|
|
Stop the deployment with `docker compose down`.
|
|
|
|
## Reverse proxy
|
|
|
|
The included `Caddyfile` sends `/mud-ws` to `svelte-mud-proxy:3001` and other requests to `svelte-mud-app:3000`. It also installs a restrictive content security policy and related browser security headers.
|
|
|
|
`TRUST_PROXY=1` must only be used when clients cannot reach the proxy container directly and the forwarding proxy overwrites `X-Forwarded-For`. Otherwise remove it so connection quotas use the actual socket address.
|
|
|
|
`ALLOWED_ORIGINS` is an exact, comma-separated allowlist. For example:
|
|
|
|
```yaml
|
|
ALLOWED_ORIGINS: https://mud.example.com
|
|
```
|
|
|
|
Do not publish port 3001 publicly. Origin checks are a browser boundary, not an authentication mechanism.
|
|
|
|
## Updating
|
|
|
|
```bash
|
|
docker compose build --pull
|
|
docker compose up -d
|
|
```
|
|
|
|
The containers run as an unprivileged user and include independent health checks for the web app and proxy.
|