diff --git a/deploy/.env.example b/deploy/.env.example index 4d68b00..e07e144 100644 --- a/deploy/.env.example +++ b/deploy/.env.example @@ -1,8 +1,5 @@ # Settings for deploy/compose.yml. Copy to deploy/.env and fill in. -# What Caddy serves: the domain alone gets HTTPS from Let's Encrypt (ports 80 -# and 443 must reach this machine). Use :80 for plain HTTP on a LAN. -SITE_ADDRESS=deadhead.belowland.com -# Host ports Caddy listens on. -HTTP_PORT=80 -HTTPS_PORT=443 +# The port on this machine that serves the game over plain HTTP. In Nginx Proxy +# Manager, forward the domain (with its SSL certificate) to http://:. +HTTP_PORT=8080 diff --git a/deploy/Caddyfile b/deploy/Caddyfile index 20e4fb5..9e94596 100644 --- a/deploy/Caddyfile +++ b/deploy/Caddyfile @@ -1,19 +1,20 @@ -# The game as static files (CR-014): it runs and saves on the player's device. -# SITE_ADDRESS is the public domain (HTTPS via Let's Encrypt), or ":80" for -# plain HTTP when testing. -{$SITE_ADDRESS} { - encode zstd gzip +# Static game files +# HTTPS is handled by Nginx Proxy Manager, which forwards to this container's port 80 - root * /srv - # Client-side routes (/fleet, /contracts…) all load the app. - try_files {path} /index.html - file_server +:80 { + encode zstd gzip - # Vite's hashed bundles and fonts never change under the same name. - @hashed path_regexp hashed ^/assets/[^/]+-[A-Za-z0-9_-]{8}\.(js|css|woff2?)$ - header @hashed Cache-Control "public, max-age=31536000, immutable" + root * /srv - # The shell and service worker must always be checked for a new version. - @shell path / /index.html /sw.js /registerSW.js /manifest.webmanifest - header @shell Cache-Control "no-cache" + # Client-side routes all load the app + try_files {path} /index.html + file_server + + # Cache hashed Vite bundles and fonts + @hashed path_regexp hashed ^/assets/[^/]+-[A-Za-z0-9_-]{8}\.(js|css|woff2?)$ + header @hashed Cache-Control "public, max-age=31536000, immutable" + + # Always revalidate app shell and service worker + @shell path / /index.html /sw.js /registerSW.js /manifest.webmanifest + header @shell Cache-Control "no-cache" } diff --git a/deploy/README.md b/deploy/README.md index a37195a..4a7722d 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -1,20 +1,23 @@ # Deploying Deadhead The game runs and saves on each player's device (CR-014), so deploying it means -serving static files. One machine runs Caddy with Docker Compose: it serves the -web build and gets HTTPS certificates for the domain automatically. There is no -server, database or backup to run; players keep their own saves (Settings → +serving static files. One Caddy container serves the web build over plain HTTP; +Nginx Proxy Manager (NPM) in front of it handles the domain and HTTPS. There is +no server, database or backup to run; players keep their own saves (Settings → Export save). ## Before the first start -1. **DNS:** point an `A` record for `deadhead.belowland.com` at the public IP of - the network the machine is on. -2. **Router:** forward TCP ports 80 and 443 (and UDP 443 for HTTP/3) to the - machine. Let's Encrypt checks port 80 before it issues a certificate. -3. **Docker:** Docker Engine with the Compose plugin (`docker compose version`). -4. **Settings:** in this folder, `cp .env.example .env` and check - `SITE_ADDRESS`. +1. **Docker:** Docker Engine with the Compose plugin (`docker compose version`). +2. **Settings:** in this folder, `cp .env.example .env` and set `HTTP_PORT` (the + port on this machine that serves the game; default 8080). +3. **NPM:** add a Proxy Host: + - Domain: `deadhead.belowland.com` + - Scheme `http`, forward hostname = this machine's IP, forward port = `HTTP_PORT` + - SSL: request a Let's Encrypt certificate and turn on Force SSL + + DNS and port forwarding (80 and 443 to the NPM machine) are NPM's, as for + any other site it serves. ## Start and update @@ -22,17 +25,17 @@ From this folder, on the machine: ```sh git pull -APP_BUILD=$(git rev-parse --short HEAD) docker compose up -d --build +APP_BUILD=$(git rev-parse --short HEAD) docker compose --env-file .env up -d --build ``` The About screen in Settings shows the build you deployed. Installed copies pick up the new version the next time they open (the service worker checks the shell on every load). -## On a LAN only (no domain) +## Without NPM -Set `SITE_ADDRESS=:80` in `.env`. Caddy then serves plain HTTP. Installing the -app to a phone home screen needs HTTPS, so this is for testing. +The site also works on its own over plain HTTP at `http://:`. +Installing the app to a phone home screen needs HTTPS, so that is for testing. ## Any other static host @@ -47,5 +50,5 @@ deploy/check.sh ``` This builds and starts the site under a separate project name on port 8088, -checks the app shell, client-side routes and caching, then removes it. It never -touches the real site. +checks the app shell, client-side routes, caching and compression, then removes +it. It never touches the real site. diff --git a/deploy/check.sh b/deploy/check.sh index a559c52..f56fefe 100755 --- a/deploy/check.sh +++ b/deploy/check.sh @@ -11,9 +11,7 @@ env_file=".check.env" port="${CHECK_PORT:-8088}" site="http://localhost:$port" cat > "$env_file" <