From 89fda37a3845c9dbcb013098e5ad41d1c20be3cf Mon Sep 17 00:00:00 2001
From: Julian Schacher <schacher@consider-it.de>
Date: Thu, 15 Feb 2024 14:58:27 +0100
Subject: [PATCH] Switch reverse-proxy to Caddy and let it handle the certs

Do this to simply the entire deployment.
---
 .../reverse-proxy/Caddyfile                   |  3 ++
 .../reverse-proxy/compose.yaml                |  9 ++--
 .../reverse-proxy/conf.d/acme_challenge.conf  | 23 ---------
 .../reverse-proxy/nginx.conf                  | 50 -------------------
 4 files changed, 8 insertions(+), 77 deletions(-)
 create mode 100644 docker_compose_applications/reverse-proxy/Caddyfile
 delete mode 100644 docker_compose_applications/reverse-proxy/conf.d/acme_challenge.conf
 delete mode 100644 docker_compose_applications/reverse-proxy/nginx.conf

diff --git a/docker_compose_applications/reverse-proxy/Caddyfile b/docker_compose_applications/reverse-proxy/Caddyfile
new file mode 100644
index 0000000..aeb2e2b
--- /dev/null
+++ b/docker_compose_applications/reverse-proxy/Caddyfile
@@ -0,0 +1,3 @@
+pdf.consider-it.de {
+    reverse_proxy 127.0.0.1:8080
+}
diff --git a/docker_compose_applications/reverse-proxy/compose.yaml b/docker_compose_applications/reverse-proxy/compose.yaml
index 833b47a..b378d39 100644
--- a/docker_compose_applications/reverse-proxy/compose.yaml
+++ b/docker_compose_applications/reverse-proxy/compose.yaml
@@ -1,12 +1,13 @@
 # Links & Resources
-# - https://hub.docker.com/_/nginx
+# - https://hub.docker.com/_/caddy
+# - https://caddyserver.com/docs/
 
 services:
   caddy:
-    image: nginx
+    image: caddy
     ports:
       - "80:80"
       - "443:443"
     volumes:
-      - "./nginx.conf:/etc/nginx/nginx.conf:ro"
-      - "./conf.d/:/etc/nginx/conf.d/:ro"
+      - "./Caddyfile:/etc/caddy/Caddyfile:ro"
+      - "/ansible_docker_compose/project_data/reverse-proxy/caddy/data:/data"
diff --git a/docker_compose_applications/reverse-proxy/conf.d/acme_challenge.conf b/docker_compose_applications/reverse-proxy/conf.d/acme_challenge.conf
deleted file mode 100644
index 1a23cb7..0000000
--- a/docker_compose_applications/reverse-proxy/conf.d/acme_challenge.conf
+++ /dev/null
@@ -1,23 +0,0 @@
-map $host $upstream_acme_challenge_host {
-    pdf.consider-it.de 127.0.0.1:8000;
-    default "";
-}
-
-server {
-    listen 80 default_server;
-
-    location /.well-known/acme-challenge/ {
-        proxy_pass http://$upstream_acme_challenge_host;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        # This is http in any case.
-        proxy_set_header X-Forwarded-Proto http;
-    }
-
-    # Better safe than sorry.
-    # Don't do a permanent redirect to avoid acme challenge pain.
-    location / {
-        return 307 https://$host$request_uri;
-    }
-}
diff --git a/docker_compose_applications/reverse-proxy/nginx.conf b/docker_compose_applications/reverse-proxy/nginx.conf
deleted file mode 100644
index 306fd98..0000000
--- a/docker_compose_applications/reverse-proxy/nginx.conf
+++ /dev/null
@@ -1,50 +0,0 @@
-# Modified nginx.conf from nginx Docker container from 2024-02-07, via the
-# following command:
-# docker run --rm --pull=always --entrypoint=cat nginx /etc/nginx/nginx.conf > ./nginx.conf
-
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log notice;
-pid        /var/run/nginx.pid;
-
-
-events {
-    worker_connections  1024;
-}
-
-# Listen on port 443 as a reverse proxy and use PROXY Protocol for the
-# upstreams.
-stream {
-    map $ssl_preread_server_name $address {
-        pdf.consider-it.de 127.0.0.1:44300;
-    }
-
-    server {
-        listen 0.0.0.0:443;
-        listen [::]:443;
-        proxy_pass $address;
-        ssl_preread on;
-        proxy_protocol on;
-    }
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-
-    sendfile        on;
-    #tcp_nopush     on;
-
-    keepalive_timeout  65;
-
-    #gzip  on;
-
-    include /etc/nginx/conf.d/*.conf;
-}