fix(self-host): tie the public address to a single origin (#2605)

2026-10-07 19:22:14 +09:00 · 2026-09-08 22:17:39 +02:00
parent 6c36d934f7
commit 8cc485cf81
17 changed files with 903 additions and 61 deletions
@@ -3,12 +3,20 @@
 # A name absent from this file is one Compose does not forward, and it reaches a
 # service only through a Compose override file that adds it to that service's
 # environment. packages/config/src/__tests__/DeployEnvCoverage.test.ts fails when
-# a Compose edit forgets the matching line here.
+# a Compose edit forgets the matching line here. Compose expands this file from
+# top to bottom, so a line written with ${...} has to sit below every name it
+# reads.

 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
 FLUXER_PUBLIC_PORT=443

+# The three lines above are the address browsers use, and every endpoint the
+# services advertise carries the port from FLUXER_PUBLIC_PORT. They do not move
+# what the host publishes. FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT further down
+# do that, and a non-default port needs the matching one set as well. Both
+# complete recipes are written out beside them.
+
 # How browsers reach this instance.
 #
 # Default: Fluxer binds 80 and 443 and gets its own Let's Encrypt certificate.
@@ -33,50 +41,71 @@ FLUXER_PUBLIC_PORT=443
 # address if it reaches Fluxer from a public IP.
 #FLUXER_EDGE_TRUSTED_PROXIES=private_ranges

-# The public origin browsers use, without a trailing slash. Derived from the three
-# values above and correct for the usual https-on-443 setup, so leave it alone
-# unless you serve Fluxer on a non-default port, where the port must appear here.
+# The origin browsers see, without a trailing slash. Leave it unset and each
+# service builds one from the three values at the top of this file. Set it and it
+# wins: every service reads the host, the scheme and the port out of it and
+# ignores those three names. Use it when browsers reach the instance on a host
+# FLUXER_DOMAIN does not name. It has to be a bare origin, a scheme and a host
+# and an optional port and nothing after them, or the services refuse to start.
+# It does not move the edge listener or the published ports either, so set the
+# publish below to the port written here.
 #FLUXER_PUBLIC_ORIGIN=https://chat.example.com

-# Overrides the address Fluxer's edge listens on. Honoured in the default mode
-# only: docker-compose.proxy.yml sets the literal :8080 and Compose lets the last
-# file win, so a value here is discarded under the proxy overlay with no warning.
-# Set it only for an unusual default-mode layout, such as serving several
-# hostnames or binding a non-default TLS port.
-#FLUXER_EDGE_SITE_ADDRESS=chat.example.com
+# Overrides the address the edge listens on inside its container. Compose builds
+# it from FLUXER_PUBLIC_SCHEME and FLUXER_DOMAIN with no port, and the edge keeps
+# its container ports at 80 and 443 whatever the public port is. Caddy matches a
+# site by host and ignores the port in the Host header, so a request arriving on
+# a non-default published port still lands on this site. Put a port in this value
+# only if you also publish that same container port below, or nothing will be
+# listening where the publish points. Honoured in the default mode only:
+# docker-compose.proxy.yml sets the literal :8080 and tunnel.compose.yml the
+# literal :80, and Compose lets the last file win, so a value here is discarded
+# under either overlay with no warning. Set it for an unusual default-mode
+# layout, such as serving several hostnames. Write the scheme into it: a bare
+# hostname means automatic HTTPS on 443 whatever FLUXER_PUBLIC_SCHEME says.
+#FLUXER_EDGE_SITE_ADDRESS=https://chat.example.com

 # The old name for the value above. It is read only when
 # FLUXER_EDGE_SITE_ADDRESS is unset, so an existing .env keeps the listener
 # it already had. Rename it to FLUXER_EDGE_SITE_ADDRESS at your convenience.
 #FLUXER_CADDY_SITE_ADDRESS=

-# FLUXER_PUBLIC_ORIGIN is the origin browsers see. It must carry the port
-# whenever FLUXER_PUBLIC_PORT is not the default for its scheme, because an
-# origin written with a default port never matches a browser Origin header.
-# Serving on any other port means setting all three, plus the published port
-# below, and pointing FLUXER_EDGE_SITE_ADDRESS at the same scheme and host.
-# Compose expands this file from top to bottom, so FLUXER_PUBLIC_ORIGIN has to
-# stay below the two values it reads. Above them it silently expands to a bare
-# host with a trailing colon.
-#FLUXER_PUBLIC_SCHEME=http
-#FLUXER_PUBLIC_PORT=19080
-#FLUXER_PUBLIC_ORIGIN=${FLUXER_PUBLIC_SCHEME}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT}
-#FLUXER_HTTP_PORT=19080
-
-# Ports Caddy publishes on the host. Caddy still listens on 80 and 443 inside
-# the container, so change only these when something else already owns the
-# standard ports or another proxy sits in front. Both take an optional bind
-# address in front of the port, and 127.0.0.1 keeps the publish off every
-# public interface. FLUXER_HTTPS_PORT moves the TCP and the UDP publish
-# together, because HTTP/3 needs both on the same port.
+# Host side of the edge's publishes, and the only two names that decide which
+# host ports Fluxer binds. The container side is fixed. Container 80 carries the
+# HTTP to HTTPS redirect and the Let's Encrypt HTTP challenge under an https
+# scheme, and the site itself under an http one. Container 443 carries the TLS
+# site. FLUXER_HTTPS_PORT moves the TCP and the UDP publish together, because
+# HTTP/3 needs both on the same port. Both take an optional bind address in front
+# of the port, and 127.0.0.1 keeps the publish off every public interface. Give
+# them different host ports: the same host port on both is two publishes of one
+# port and the edge refuses to start.
 #FLUXER_HTTP_PORT=80
 #FLUXER_HTTPS_PORT=443
 #FLUXER_HTTP_PORT=127.0.0.1:80
 #FLUXER_HTTPS_PORT=127.0.0.1:443

+# HTTPS on 8443, complete. Host 80 stays published and still answers the ACME
+# challenge. Let's Encrypt only ever connects to the public 80 or 443, so the
+# certificate is issued if a router in front forwards public 80 to this host and
+# is not issued otherwise. Serve your own certificate from the Caddyfile when it
+# cannot.
+#FLUXER_PUBLIC_PORT=8443
+#FLUXER_HTTPS_PORT=8443
+
+# Plain HTTP on 19080, complete. The port 80 publish moves to 19080, so nothing
+# binds host 80. Under an http scheme nothing listens on container 443, so the
+# last line parks that publish on loopback for a host that wants 443 for
+# something else. Drop it and 443 is published and idle, which is what earlier
+# releases did.
+#FLUXER_PUBLIC_SCHEME=http
+#FLUXER_PUBLIC_PORT=19080
+#FLUXER_HTTP_PORT=19080
+#FLUXER_HTTPS_PORT=127.0.0.1:443
+
 # A tunnel or another proxy in front of the stack needs no HTTPS publish at all.
 # tunnel.compose.yml ships beside this file and replaces Caddy's published ports
-# with a single loopback HTTP publish, so nothing binds 443. FLUXER_HTTP_PORT
+# with a single loopback HTTP publish, so nothing binds 443, and points the edge
+# at plain HTTP on that publish so it stops redirecting to https. FLUXER_HTTP_PORT
 # still moves that one publish. Set the line below and plain docker compose
 # commands pick the file up, or add it to your own -f flags if you pass any. The
 # file uses the !override tag, which needs Compose 2.24.4 or newer.
@@ -153,9 +182,11 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 LIVEKIT_API_KEY=fluxer
 LIVEKIT_API_SECRET=CHANGE_ME

-# The URL browsers use for voice signalling. Derived from FLUXER_PUBLIC_SCHEME,
-# FLUXER_DOMAIN and FLUXER_PUBLIC_PORT as wss://host[:port]/livekit when empty.
-# Set it only when LiveKit is served from another host.
+# The URL browsers use for voice signalling. Compose builds it from
+# FLUXER_PUBLIC_ORIGIN, or from FLUXER_PUBLIC_SCHEME, FLUXER_DOMAIN and
+# FLUXER_PUBLIC_PORT, as that origin followed by /livekit. The client rewrites a
+# leading http to ws itself. Set it only when LiveKit is served from another
+# host.
 #FLUXER_LIVEKIT_URL=

 # Media ports. LiveKit advertises these in ICE candidates, so the host must
@@ -18,6 +18,7 @@ x-fluxer-env: &fluxer-env
  FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
  FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
  FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
+  FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
  FLUXER_TRUST_CLIENT_IP_HEADER: "true"
  FLUXER_CLIENT_IP_HEADER_NAME: x-forwarded-for
  FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-30000}
@@ -56,7 +57,7 @@ x-fluxer-env: &fluxer-env
  FLUXER_LIVEKIT_INTERNAL_URL: http://livekit:7880
  FLUXER_LIVEKIT_WEBHOOK_URL: http://api:8080/webhooks/livekit
  FLUXER_LIVEKIT_DEFAULT_REGION: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}'
-  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/livekit}
+  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}/livekit}

  FLUXER_KLIPY_API_KEY: ${FLUXER_KLIPY_API_KEY:-}

@@ -132,7 +133,7 @@ services:
      - "${FLUXER_HTTPS_PORT:-443}:443"
      - "${FLUXER_HTTPS_PORT:-443}:443/udp"
    environment:
-      FLUXER_EDGE_SITE_ADDRESS: ${FLUXER_EDGE_SITE_ADDRESS:-${FLUXER_CADDY_SITE_ADDRESS:-${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}}}
+      FLUXER_EDGE_SITE_ADDRESS: ${FLUXER_EDGE_SITE_ADDRESS:-${FLUXER_CADDY_SITE_ADDRESS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}}}
      FLUXER_EDGE_TRUSTED_PROXIES: ${FLUXER_EDGE_TRUSTED_PROXIES:-private_ranges}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
@@ -494,6 +495,10 @@ services:
    environment:
      FLUXER_APP_PROXY_HOST: 0.0.0.0
      FLUXER_APP_PROXY_PORT: "8080"
+      FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
+      FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
+      FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
+      FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
      DISCOVERY_UPSTREAM_URL: http://edge:8088/.well-known/fluxer
      PUBLIC_BOOTSTRAP_API_ENDPOINT: /api
      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api
@@ -2,3 +2,5 @@ services:
  edge:
    ports: !override
      - "${FLUXER_HTTP_PORT:-127.0.0.1:80}:80"
+    environment:
+      FLUXER_EDGE_SITE_ADDRESS: ":80"