feat(deploy): add the self-hosting stack (Caddy + oauth2-proxy + mongo)#129
Merged
Conversation
deploy/ brings up glabs.cs.hm.edu: Caddy terminates TLS (HM CA via EAB) and authenticates every request against oauth2-proxy (OIDC to sso.hm.edu), injecting X-Remote-User authoritatively — including on `/`, so the GUI's cookieless SSR hop can relay it to the backend. glabs-web, gui, mongo and oauth2-proxy stay on the internal network; only Caddy publishes 80/443 (mongo binds 127.0.0.1:27017 for an SSH tunnel). - docker-compose.yml: mongo (healthcheck + volume) + glabs-web + gui + oauth2-proxy + caddy, backend/gui from ghcr.io. No gh-runner. - Caddyfile: /query* -> glabs-web:8080 (GraphQL + WS), everything else -> gui:3000 (glabs-web serves nothing but /query; the YAML download is a GUI route). No department/groups header — glabs identity is just the email. - .env.example + .glabs-web.yaml.example (secrets/EAB/OIDC placeholders, gitignored real files) + README (setup, ACME/EAB, the SSR two-URL trap, operating, Mongo SSH tunnel, backups). Second and final core Milestone-F PR; references the glabs-web image from #128. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Zweiter (und letzter Kern-)Milestone-F-PR: der
deploy/-Stack für glabs.cs.hm.edu. Referenziert dasglabs-web-Image aus #128 und dasglabs.gui-Image.Topologie
Inhalt
docker-compose.yml— mongo (healthcheck + Volume) + glabs-web + gui + oauth2-proxy + caddy; Backend/GUI als ghcr.io-Images (GLABS_WEB_TAG/GUI_TAG). Nur Caddy publiziert 80/443; Mongo nur127.0.0.1:27017(SSH-Tunnel). Kein gh-runner (wie besprochen).Caddyfile— eigenes EAB fürs HM-ACME (frischer kid/hmac, nicht acme.sh-Account);X-Remote-Userauch auflocation /(SSR-Falle);/query*→Backend (WS-Upgrade automatisch), Rest→GUI. Kein Department/Groups-Header (glabs-Identität = E-Mail, nur Owner)..env.example+.glabs-web.yaml.example(Platzhalter für Secrets/EAB/OIDC; reale Dateien via.gitignore) +README.md(Setup, ACME/EAB-Fallstrick, Zwei-URL-SSR-Falle, Betrieb, Mongo-SSH-Tunnel, Backups).Verifikation (lokal)
docker compose --env-file .env.example config— grün, 5 Services; gerendert geprüft: GUI-URLs (intern/öffentlich), Backend-.glabs-web.yamlread-only bind-mount, nur caddy 80/443 + mongo-loopback publiziert.caddy validate— Valid configuration (EAB-Block + auto-HTTPS adaptieren sauber).serverInfo.version=v3.37.0; GUI-SSR/courses→ HTTP 200 (der SSR-load()-Hop erreicht das Backend intern, keine SSR-Falle). Images sind anonym pullbar (kein ghcr-Login am Host nötig).🤖 Generated with Claude Code