fix(demo-service): move Caddyfile to dedicated ConfigMap manifest

- Extract Caddyfile from demo-service.yaml into demo-service-caddy.yaml - ArgoCD auto-applies both files; Caddyfile changes are tracked in git - Fixes issue where Caddyfile updates in the source dir weren't reaching the pod
2026-08-08 20:15:03 +10:00 · 2026-06-14 12:25:48 +10:00
parent c161f29423
commit 492ed0c3e5
2 changed files with 60 additions and 56 deletions
@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: demo-caddy-config
+  namespace: home-apps
+data:
+  Caddyfile: |
+    # Caddy for Demo Service — internal server, TLS handled by Nginx Ingress
+    
+    :80 {
+        log {
+            output stdout
+            format json
+        }
+    
+        # ── Custom error pages (canvas animation, served directly by Caddy) ──
+        handle_errors {
+            @html_errors expression `{err.status_code} in [401, 403, 404]`
+            handle @html_errors {
+                root * /app/static
+                rewrite * /error-page.html
+                file_server
+            }
+        }
+    
+        # Management API → Python service
+        handle /api/* {
+            reverse_proxy localhost:3000 {
+                header_up Host {host}
+                header_up X-Forwarded-For {remote_host}
+                header_up X-Forwarded-Proto https
+            }
+        }
+    
+        # Admin Web UI → Python service
+        handle /admin {
+            reverse_proxy localhost:3000
+        }
+        handle /admin/* {
+            reverse_proxy localhost:3000
+        }
+    
+        # ── Site content: API handles visibility + auth ──
+        # Public sites served without auth; drafts require login
+        handle {
+            rewrite * /site-content{uri}
+            reverse_proxy localhost:3000 {
+                header_up Host {host}
+                header_up X-Forwarded-For {remote_host}
+                header_up X-Forwarded-Proto https
+                header_up Cookie {http.request.header.Cookie}
+            }
+        }
+    
+        header {
+            X-Content-Type-Options nosniff
+            X-Frame-Options SAMEORIGIN
+            -Server
+        }
+    }
@@ -11,62 +11,6 @@ spec:
      storage: 10Gi
  storageClassName: nfs-client
 ---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: demo-caddy-config
-  namespace: home-apps
-data:
-  Caddyfile: |
-    # Caddy for Demo Service — internal server, TLS handled by Nginx Ingress
-    # Auth is handled by the Python API
-
-    :80 {
-        log {
-            output stdout
-            format json
-        }
-
-        handle /api/* {
-            reverse_proxy localhost:3000 {
-                header_up Host {host}
-                header_up X-Forwarded-For {remote_host}
-                header_up X-Forwarded-Proto https
-            }
-        }
-
-        handle /admin {
-            reverse_proxy localhost:3000
-        }
-        handle /admin/* {
-            reverse_proxy localhost:3000
-        }
-
-        handle / {
-            reverse_proxy localhost:3000
-        }
-
-        # Block access to internal files
-        @blocked path_regexp blocked \.(draft|bak)$
-        handle @blocked {
-            error 404
-        }
-
-        # Static demo sites — public
-        handle_path /* {
-            root * /data/demos
-            file_server {
-                index index.html
-            }
-        }
-
-        header {
-            X-Content-Type-Options nosniff
-            X-Frame-Options SAMEORIGIN
-            -Server
-        }
-    }
---
 apiVersion: apps/v1
 kind: Deployment
 metadata: