feat(deploy): add optional Admin HTTPS (#5)

Author: strahe

.env.example

@@ -1,5 +1,8 @@
-# Optional core container config overrides.
-# Uncomment values you want to set through environment variables.
+# SynapS3 container config overrides.
+# make docker-init adds the selected Compose files and optional Admin HTTPS
+# domain above this block. Keep secrets out of command-line arguments.
+# Set the Filecoin private key below before serving normal S3 traffic.
+# Other entries are optional environment overrides.
 # Full configuration reference:
 # https://github.com/strahe/SynapS3/blob/main/docs/en/configuration/environment.md
 

.github/workflows/docker.yml

@@ -29,9 +29,8 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  image_pr:
-    name: image-pr
-    if: github.event_name == 'pull_request'
+  deployment:
+    name: deployment
     runs-on: ${{ vars.RUNS_ON_AMD64 || vars.RUNS_ON || 'ubuntu-latest' }}
     timeout-minutes: 10
 
@@ -40,6 +39,20 @@ jobs:
         name: Checkout
         uses: actions/checkout@v6
 
+      - name: Validate Docker deployment
+        env:
+          SYNAPS3_REQUIRE_DOCKER_DAEMON: '1'
+        run: make test-docker-deployment
+
+  image_pr:
+    name: image-pr
+    if: github.event_name == 'pull_request'
+    runs-on: ${{ vars.RUNS_ON_AMD64 || vars.RUNS_ON || 'ubuntu-latest' }}
+    timeout-minutes: 10
+
+    steps:
+      - *checkout
+
       - &setup-buildx
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

Makefile

@@ -7,14 +7,17 @@ GOFLAGS  := -trimpath
 CGO_ENABLED := 1
 CGO      := CGO_ENABLED=$(CGO_ENABLED)
 
+DOCKER_DEPLOYMENT ?= sh docker/deployment.sh
+
 VERSION  := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 COMMIT   := $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
 DATE     := $(shell date -u '+%Y-%m-%dT%H:%M:%SZ')
 LDFLAGS  := -X $(MODULE)/internal/buildinfo.Version=$(VERSION) \
             -X $(MODULE)/internal/buildinfo.Commit=$(COMMIT) \
             -X $(MODULE)/internal/buildinfo.Date=$(DATE)
 
-.PHONY: all build build-go build-systemtest-server build-integration-server docs-build test test-fast test-race test-system test-integration test-ui-e2e test-docker-entrypoint lint fmt check verify-e2e verify-fast verify-norace verify-race clean run ui-install ui-build ui-dev ui-e2e-install
+.PHONY: all build build-go build-systemtest-server build-integration-server docs-build test test-fast test-race test-system test-integration test-ui-e2e test-docker-entrypoint test-docker-deployment lint fmt check verify-e2e verify-fast verify-norace verify-race clean run ui-install ui-build ui-dev ui-e2e-install
+.PHONY: docker-init docker-up docker-verify docker-down docker-status docker-logs docker-password
 
 all: build
 
@@ -66,6 +69,30 @@ test-ui-e2e:
 test-docker-entrypoint:
 	sh docker/entrypoint.test.sh
 
+test-docker-deployment:
+	sh docker/deployment.test.sh
+
+docker-init:
+	@$(DOCKER_DEPLOYMENT) init
+
+docker-up:
+	@$(DOCKER_DEPLOYMENT) up
+
+docker-verify:
+	@$(DOCKER_DEPLOYMENT) verify
+
+docker-down:
+	@$(DOCKER_DEPLOYMENT) down
+
+docker-status:
+	@$(DOCKER_DEPLOYMENT) status
+
+docker-logs:
+	@$(DOCKER_DEPLOYMENT) logs
+
+docker-password:
+	@$(DOCKER_DEPLOYMENT) password
+
 lint:
 	@command -v golangci-lint >/dev/null 2>&1 || { echo "golangci-lint not found"; exit 1; }
 	$(CGO) golangci-lint run

compose.admin-https.yaml

@@ -0,0 +1,32 @@
+services:
+  synaps3:
+    environment:
+      SYNAPS3_ADMIN_ADDR: 127.0.0.1:9090
+      SYNAPS3_ADMIN_AUTH_ENABLED: "true"
+      SYNAPS3_ADMIN_TRUSTED_PROXIES: 127.0.0.1/32
+
+  caddy:
+    image: caddy:2.11.4-alpine
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      ADMIN_DOMAIN: ${ADMIN_DOMAIN:?Set ADMIN_DOMAIN in .env to the public Admin hostname}
+    depends_on:
+      synaps3:
+        condition: service_started
+    configs:
+      - source: synaps3-admin-caddyfile
+        target: /etc/caddy/Caddyfile
+    volumes:
+      - caddy-data:/data
+      - caddy-config:/config
+
+configs:
+  synaps3-admin-caddyfile:
+    file: ./docker/Caddyfile
+
+volumes:
+  caddy-data:
+    name: synaps3-caddy-data
+  caddy-config:
+    name: synaps3-caddy-config

docker/Caddyfile

@@ -0,0 +1,9 @@
+{
+	admin off
+}
+
+{$ADMIN_DOMAIN} {
+	# Keep HSTS scoped to the Admin hostname; other subdomains may use different TLS policies.
+	header Strict-Transport-Security "max-age=31536000"
+	reverse_proxy 127.0.0.1:9090
+}