feat: [#272] Add HTTPS support with Caddy for all HTTP services #273
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Add Context Data Preparation Pattern section to template architecture docs - Explain why templates receive pre-processed data instead of raw domain objects - Document port extraction example: handled in Rust, not Tera filters - Update issue spec to use port-as-integer pattern in Caddyfile template - Remove extract_port Tera filter from implementation plan (not needed) This follows existing patterns (e.g., PrometheusContext receives api_port: u16) and maintains consistency with the codebase's approach to template rendering.
- Add Caddyfile.tera template with conditional service blocks - Update docker-compose.yml.tera with Caddy service configuration - Add proxy_network and caddy volumes - Add caddy.md documentation for template usage - Update template-system-architecture.md with directory organization rule - Update issue progress tracking
- Create CaddyProjectGenerator following Project Generator pattern - Create CaddyContext with pre-processed data for template rendering - Create CaddyService struct with domain and port fields - Create CaddyfileRenderer for Caddyfile template processing - Add 14 unit tests covering all HTTPS scenarios - Update issue progress tracking (Phase 3 mostly complete)
Implement Caddy reverse proxy with TLS termination for automatic HTTPS: Phase 1 - Template Creation: - Create Caddyfile.tera template with conditional service blocks - Create caddy.md documentation for template variables - Update docker-compose.yml.tera with Caddy service block - Register templates in CaddyProjectGenerator with 14 unit tests Phase 2 - Configuration DTOs: - Add HttpsSection DTO with admin_email and use_staging fields - Add TlsSection DTO with domain field for service-specific TLS - Extend HttpApiSection, HttpTrackerSection, GrafanaSection with optional tls - Implement validation (has_any_tls_configured, https/tls consistency) - Add Email type in src/shared/email.rs for email format validation - Add DomainName type in src/shared/domain_name.rs for domain validation Phase 3 - Template Rendering Integration: - Create RenderCaddyTemplatesStep for template rendering - Create DeployCaddyConfigStep for Ansible deployment - Create deploy-caddy-config.yml Ansible playbook - Add RenderCaddyTemplates and DeployCaddyConfigToRemote to ReleaseStep enum - Integrate CaddyContext into Docker Compose template rendering - Add CaddyConfigDeployment error variant with actionable help text Manual E2E testing verified: - HTTPS endpoints working for API, Grafana, and HTTP trackers - HTTP→HTTPS redirect (308 Permanent Redirect) - HTTP/2 and HTTP/3 enabled - Caddy Local CA for .local domains Work in progress - remaining phases: - Phase 4: Security workflow updates - Phase 5: Documentation - Phase 6: Automated E2E tests - Phase 7: Schema generation - Phase 8: ADR creation
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add HTTPS support with Caddy reverse proxy for automatic TLS termination on all HTTP services (Tracker API, HTTP Trackers, Grafana).
Closes #272
What's Implemented
Phase 1: Template Creation ✅
templates/caddy/Caddyfile.terawith conditional service blocksdocs/contributing/templates/caddy.mddocumenting template variablestemplates/docker-compose/docker-compose.yml.terawith Caddy service blockCaddyProjectGeneratorwith 14 unit testsPhase 2: Configuration DTOs ✅
HttpsSectionDTO withadmin_emailanduse_stagingfieldsTlsSectionDTO withdomainfield for service-specific TLSHttpApiSection,HttpTrackerSection,GrafanaSectionwith optionaltlshas_any_tls_configured, https/tls consistency)Emailtype insrc/shared/email.rsfor email format validationDomainNametype insrc/shared/domain_name.rsfor domain validationPhase 3: Template Rendering Integration ✅
RenderCaddyTemplatesStepfor template renderingDeployCaddyConfigStepfor Ansible deploymentdeploy-caddy-config.ymlAnsible playbookRenderCaddyTemplatesandDeployCaddyConfigToRemotetoReleaseStepenumCaddyContextinto Docker Compose template renderingCaddyConfigDeploymenterror variant with actionable help textPhase 6: E2E Testing (Partial) ✅
Manual E2E testing verified:
.localdomainsWhat's Remaining (Work in Progress)
docs/user-guide/https-setup.md)Configuration Example
{ "https": { "admin_email": "admin@example.com", "use_staging": true }, "tracker": { "http_api": { "bind_address": "0.0.0.0:1212", "admin_token": "secret", "tls": { "domain": "api.tracker.local" } }, "http_trackers": [ { "bind_address": "0.0.0.0:7070", "tls": { "domain": "http1.tracker.local" } } ] }, "grafana": { "admin_user": "admin", "admin_password": "admin", "tls": { "domain": "grafana.tracker.local" } } }Testing
Notes for Reviewers
This is a draft PR - the implementation is functional but there are still remaining phases to complete. Early feedback on the architecture and approach is welcome.
Key files to review:
templates/caddy/Caddyfile.tera- Caddy templatesrc/application/command_handlers/create/config/https.rs- HTTPS configuration DTOssrc/application/command_handlers/release/handler.rs- Release workflow integrationsrc/infrastructure/templating/caddy/- Caddy template rendering