edge-stack

Shipped. github.com/abdurahmon27/edge-stack 

Four projects on one server, four opinions about the front door. One ships Caddy, one terminates TLS inside the app, one wants a hand-written nginx vhost, one grabs port 80 first. Then a cert expires and nobody remembers whose job it was.

So: one proxy, one config file.

- domain: app.example.com
  networks: [myapp_default]
  routes:
    - path: /api/
      upstream: myapp-api:8080
      strip_prefix: true
    - path: /
      upstream: myapp-web:80

edgectl apply issues the cert, generates the vhost, joins the app’s docker network, runs nginx -t, reloads. edgectl status gives me an HTTP code per domain.

Three things took most of the time:

• resolver 127.0.0.11 valid=10s — docker’s DNS, re-resolved every ten seconds. Without it a redeploy gives the container a new IP and the proxy keeps pointing at the old one.
• Cert before HTTPS vhost. You can’t get a cert for a domain the proxy can’t serve yet, so the HTTP vhost goes up first.
• nginx -t before every reload. One shared front door means one bad config takes down every site at once.

Caddy would have covered most of it. I wanted the inventory more than the automation: one file that says which domains live on this box and where they point. It’s now in front of shoshshi and oris.