multica deployment

ansible/roles/multica_docker/templates/Caddyfile.j2

@@ -0,0 +1,73 @@
+# Managed by Ansible (multica_docker) - local changes will be overwritten
+{
+{% if caddy_acme_email | length > 0 %}
+	email {{ caddy_acme_email }}
+{% endif %}
+{% if caddy_http_port | int != 80 %}
+	http_port {{ caddy_http_port }}
+{% endif %}
+{% if caddy_https_port | int != 443 %}
+	https_port {{ caddy_https_port }}
+{% endif %}
+{% if caddy_tls_mode == 'cloudflare_dns' %}
+	acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+{% endif %}
+}
+
+{% if multica_layout == 'single' %}
+{{ multica_domain }} {
+{% if caddy_tls_mode == 'internal' %}
+	tls internal
+{% endif %}
+	# CLI reachability probe: `multica setup` GETs <server-url>/health and needs a 200
+	handle /health {
+		reverse_proxy 127.0.0.1:{{ _multica_backend_port }}
+	}
+
+	# Browser realtime WebSocket (the web image cannot proxy WS upgrades)
+	handle /ws {
+		reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
+			flush_interval -1
+		}
+	}
+
+	# Daemon long-connection WebSocket: daemons dial {server-url}/api/daemon/ws
+	handle /api/daemon/ws {
+		reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
+			flush_interval -1
+		}
+	}
+
+	# Everything else goes to the frontend, which forwards API and login requests
+	handle {
+		reverse_proxy 127.0.0.1:{{ _multica_frontend_port }}
+	}
+}
+{% else %}
+{{ multica_app_domain }} {
+{% if caddy_tls_mode == 'internal' %}
+	tls internal
+{% endif %}
+	# Hand browser WebSockets straight to the backend
+	@ws path /ws /ws/*
+	handle @ws {
+		reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
+			flush_interval -1
+		}
+	}
+
+	# Everything else goes to the frontend, which forwards API and login requests
+	handle {
+		reverse_proxy 127.0.0.1:{{ _multica_frontend_port }}
+	}
+}
+
+{{ multica_api_domain }} {
+{% if caddy_tls_mode == 'internal' %}
+	tls internal
+{% endif %}
+	reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
+		flush_interval -1
+	}
+}
+{% endif %}

ansible/roles/multica_docker/templates/Dockerfile.caddy.j2

@@ -0,0 +1,6 @@
+# Managed by Ansible (multica_docker)
+FROM caddy:{{ caddy_version }}-builder AS builder
+RUN xcaddy build --with github.com/caddy-dns/cloudflare
+
+FROM caddy:{{ caddy_version }}
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy

ansible/roles/multica_docker/templates/caddy.env.j2

@@ -0,0 +1 @@
+CLOUDFLARE_API_TOKEN={{ caddy_cloudflare_api_token }}

ansible/roles/multica_docker/templates/docker-compose.caddy.yml.j2

@@ -0,0 +1,26 @@
+# Managed by Ansible (multica_docker)
+name: caddy
+services:
+  caddy:
+    container_name: {{ caddy_container_name }}
+{% if caddy_tls_mode == 'cloudflare_dns' %}
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: local/caddy-cloudflare:{{ caddy_version }}
+    env_file:
+      - caddy.env
+{% else %}
+    image: caddy:{{ caddy_version }}
+{% endif %}
+    # Host networking: Multica's ports are bound to 127.0.0.1 only
+    network_mode: host
+    restart: unless-stopped
+    volumes:
+      - {{ caddy_install_dir }}/conf:/etc/caddy:ro
+      - caddy_data:/data
+      - caddy_config:/config
+
+volumes:
+  caddy_data:
+  caddy_config: