Jannis Braun
531b496618
Make Backspace self-hostable in any homelab environment, not just a clean host
that owns ports 80/443.
install.sh is now mode-aware and auto-detects which fits:
- allinone (default): bundled Caddy + auto-HTTPS — unchanged behavior
- proxy: behind your own reverse proxy (nginx / Traefik / Caddy / Nginx Proxy
Manager / SWAG) — app published on 127.0.0.1:APP_PORT, no bundled Caddy,
prints paste-ready proxy snippets
- tunnel: behind a tunnel (Cloudflare / Tailscale) — same, plus a 90MB upload
cap (under Cloudflare's 100MB body limit) and voice force-disabled (WebRTC
over UDP can't traverse a tunnel)
Port detection is Docker-aware (consults `docker ps` published ports, not just
`ss`), so a host whose proxy already owns 80/443 via iptables DNAT — with no
listening socket for `ss` to see — is correctly detected as "taken" instead of
dead-ending.
docker-compose.proxy.yml is a small overlay, layered via COMPOSE_FILE (written
into .env so no `-f` flags are ever needed), that publishes the loopback port and
parks Caddy in an inert profile. The base compose file is untouched, so All-in-One
behaves exactly as before.
Prebuilt image: .github/workflows/docker-publish.yml builds and pushes a
multi-arch (linux/amd64 + linux/arm64) image to ghcr.io/thezwiss/backspace on
release tags (and manual dispatch), so weak/ARM hosts skip the ~1.6GB local build
(the Vite build OOMs small ARM boxes). install.sh and docker-compose.yml default
to pulling it, fall back to an image already present on the host, and finally to a
from-source build — AGPL §13 commit stamping preserved on every path. Kept
deliberately separate from the desktop-installer workflow (release.yml).
Docs: README gains a "Deployment modes" section (all three modes, nginx / Caddy /
Traefik snippets, GUI-proxy field-by-field, cloudflared ingress, the update path,
and voice-per-mode caveats); docs/systems/deployment.md updated to match.
Verified live on a throwaway VM: proxy + all-in-one end-to-end through install.sh
(with a real Let's Encrypt cert), tunnel config generation, loopback-only binding,
and the local-image fallback path.
37 lines
1.8 KiB
YAML
37 lines
1.8 KiB
YAML
# ============================================================
|
|
# Backspace — Reverse-proxy / Tunnel override
|
|
# ============================================================
|
|
# Overlay for Mode 2 (behind your own reverse proxy) and Mode 3 (tunnel, e.g.
|
|
# Cloudflare Tunnel / Tailscale). Layer it on top of the base compose file:
|
|
#
|
|
# docker compose -f docker-compose.yml -f docker-compose.proxy.yml up -d
|
|
#
|
|
# What it changes versus the all-in-one base:
|
|
# 1. Publishes the app on 127.0.0.1:${APP_PORT} (loopback only) so your own
|
|
# reverse proxy or tunnel daemon on the same host can reach it. Nothing is
|
|
# exposed on a public interface by this stack — TLS/termination is the
|
|
# proxy's job.
|
|
# 2. Moves the bundled Caddy into a profile that is never activated here, so it
|
|
# does NOT start (your proxy owns 80/443). The base file leaves Caddy in the
|
|
# default profile, so Mode 1 (`-f docker-compose.yml` alone) is unchanged.
|
|
#
|
|
# ./install.sh selects the right `-f` combination automatically per mode; this
|
|
# file is also usable by hand for a fully manual setup.
|
|
# ============================================================
|
|
|
|
services:
|
|
backspace:
|
|
# Bind to loopback only. The reverse proxy / tunnel connects over 127.0.0.1;
|
|
# the app is never reachable directly from the network. Container listens on
|
|
# PORT (default 3000); APP_PORT is the host-side port your proxy forwards to.
|
|
ports:
|
|
- "127.0.0.1:${APP_PORT:-8080}:${PORT:-3000}"
|
|
|
|
caddy:
|
|
# Park Caddy in a profile that install.sh / the documented commands never
|
|
# enable, so the merged config drops it in proxy/tunnel mode. (Compose
|
|
# replaces the `profiles` list on merge; the base service has none, so this
|
|
# is the effective value only when this override is layered on.)
|
|
profiles:
|
|
- _proxy_mode_no_caddy
|