Multi-arch GHCR CI/CD + split dev/prod docker compose (no edge Caddy)#10
Merged
Conversation
- .github/workflows/docker-publish.yml builds frontend/api/dxspider-bridge for linux/amd64+arm64 via buildx+QEMU, pushing to GHCR on main/tags (PRs get an amd64-only build-check, no push) - docker-compose.prod.yml runs the published images (no build/source needed on the VPS); docker-compose.yml stays the build-from-source dev stack - Caddyfile's site address is now env-driven (SITE_ADDRESS, defaults to plain :80) so prod TLS is a .env change, not a tracked-file edit - .env.example documents DXSPIDER_LOGIN/SITE_ADDRESS/GHCR_OWNER/IMAGE_TAG - .dockerignore per service, Makefile prod-* targets, README deployment docs
The edge Caddy's only real jobs were TLS/ACME (redundant when a host-level reverse proxy already terminates TLS) and routing /api + /data to the right container — the latter now lives in frontend's own Caddy instance, which was already running a Caddy process anyway. Cuts a container/image and matches DESIGN.md's §10 service list, which never listed a separate caddy entry. frontend now binds to 127.0.0.1:$SKYWAVE_PORT in prod (default 8080) for an external reverse proxy to target; dev keeps the plain :80 publish.
d3mocide
changed the title
d3mocide
marked this pull request as ready for review
July 10, 2026 19:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/docker-publish.yml: buildsfrontend/api/dxspider-bridgeforlinux/amd64+linux/arm64(buildx + QEMU) and pushes to GHCR on push tomain(taglatest) and version tagsvX.Y.Z. PRs get an amd64-only build-check with no push, to catch broken Dockerfiles before merge.docker-compose.prod.yml: standalone production stack that runs the published GHCR images — no source checkout or build tooling needed on the VPS.docker-compose.ymlremains the build-from-source dev stack./api+/datato the right container. TLS is redundant when a host-level reverse proxy already terminates HTTPS in front, so that job goes away; the routing job moves intofrontend's own Caddy instance (it was already running a Caddy process to serve the static PWA). This also matchesDESIGN.md§10's service list, which never listed a separatecaddyentry.frontendbinds to127.0.0.1:$SKYWAVE_PORT(default8080) in prod for an external reverse proxy to target; dev keeps the plain:80publish..env.exampledocumentingDXSPIDER_LOGIN,DXSPIDER_NODES,SKYWAVE_PORT,GHCR_OWNER,IMAGE_TAG..dockerignore(frontend/backend/dxspider-bridge) to keep build contexts small.make prod-up/prod-down/prod-pull/prod-logs/prod-pstargets.README.md, plus the one-time step to make GHCR packages public after the first publish.Test plan
docker compose configvalidates bothdocker-compose.ymlanddocker-compose.prod.ymldocker-compose.prod.ymlfails fast with a clear message whenDXSPIDER_LOGINis unsethandle/handle_pathblock structure against the pre-existing (working) root Caddyfile it was merged frommain(nothing to push to GHCR until this lands)docker-compose.prod.ymlrun against published images behind a real host-level reverse proxy on a VPS