From 06d47e5f078f48e76f18067720cf86d0486c8565 Mon Sep 17 00:00:00 2001 From: Ash Date: Wed, 2 Sep 2026 16:27:42 +0000 Subject: [PATCH] docker: Align compose healthcheck with admin port The compose healthcheck probes http://127.0.0.1:81/api, but the binary defaults ADMIN_PORT to 8081, so a stock compose up never becomes healthy. Set ADMIN_PORT, PROXY_HTTP_PORT, and PROXY_HTTPS_PORT in compose so the process listens on the Dockerfile EXPOSE ports. Document real binary defaults in the README and keep the Docker section on 80/81/443 via env. Link: https://git.s1d3sw1ped.com/s1d3sw1ped/helix-proxy/issues/10 --- README.md | 16 +++++++++++----- docker-compose.yml | 20 ++++++++++++-------- 2 files changed, 23 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index ffe3e48..1a3eca9 100644 --- a/README.md +++ b/README.md @@ -13,22 +13,28 @@ A pure-Go reverse proxy with embedded web UI. Supports proxy hosts, TCP/UDP stre ```bash make # builds UI (placeholder) + Go binary with embed ./helix-proxy -# Admin UI + API on :81 -# Proxy on :8080 (or 80/443 when you have perms / run in docker) +# Admin UI + API on 127.0.0.1:8081 +# Proxy HTTP on :8080, HTTPS on :18443 ``` -Visit http://localhost:81 +Visit http://localhost:8081 Data (db, certs, logs, www html) lives in `./data` relative to where you ran the binary. ## Docker (recommended) ```bash docker compose up -d +# compose sets ADMIN_PORT=81 PROXY_HTTP_PORT=80 PROXY_HTTPS_PORT=443 +# proxy :80/:443 published; admin binds 127.0.0.1:81 (not published by default) # or docker build -t helix-proxy:dev . -docker run -p 81:81 -v $PWD/data:/app/data --workdir /app helix-proxy:dev +docker run -p 80:80 -p 443:443 \ + -e ADMIN_PORT=81 -e PROXY_HTTP_PORT=80 -e PROXY_HTTPS_PORT=443 \ + -v $PWD/data:/app/data --workdir /app helix-proxy:dev ``` +Publishing admin (`-p 81:81`) also needs `-e ADMIN_HOST=0.0.0.0`. Do not publish :81 on untrusted networks. + PUID/PGID + DISABLE_IPV6 example (see docker-compose.yml for full): ```yaml # user: "0:0" # root to allow chown+drop inside @@ -41,7 +47,7 @@ environment: Binary auto-chowns data tree (if started root) then drops privs (unless PUID_NO_DROP); umask support via UMASK env. Files 0600, dirs 0755. Note: privilege drop happens early (before listeners); low-port binds require either root (with PUID_NO_DROP), capabilities, high ports in config, or external setuid wrapper. -See docker-compose.yml for full example (exposes 80/81/443, volume for data/). +See docker-compose.yml for full example (listens on 80/81/443 via env, publishes 80/443, volume for data/). ## Paths (all overridable) - `data/db.bolt` (or `DATA_DIR`) diff --git a/docker-compose.yml b/docker-compose.yml index 6a123cf..0596301 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,14 +12,18 @@ services: - ./data:/app/data # user: "0:0" # required when using PUID/PGID != built-in to allow binary to chown+drop # working_dir: /app # binary uses CWD for relative data/ + data/www/ - # environment: - # - JWT_SECRET= # optional; otherwise a random secret is stored in data/.jwt_secret - # - DATA_DIR=/app/data - # - WWW_DIR=/app/data/www - # - PUID=1000 - # - PGID=1000 - # - DISABLE_IPV6=1 - # # PUID_NO_DROP=1 # if using low ports (80/443) + PUID: chown as root but skip drop (stay root for bind; default drop runs as PUID after, requires high ports or NET_BIND_SERVICE cap) + environment: + - ADMIN_PORT=81 + - PROXY_HTTP_PORT=80 + - PROXY_HTTPS_PORT=443 + # ADMIN_HOST defaults to 127.0.0.1 (healthcheck hits 127.0.0.1:81) + # - JWT_SECRET= # optional; otherwise a random secret is stored in data/.jwt_secret + # - DATA_DIR=/app/data + # - WWW_DIR=/app/data/www + # - PUID=1000 + # - PGID=1000 + # - DISABLE_IPV6=1 + # # PUID_NO_DROP=1 # if using low ports (80/443) + PUID: chown as root but skip drop (stay root for bind; default drop runs as PUID after, requires high ports or NET_BIND_SERVICE cap) # To use optional SQL backend instead of default yaml: # - DB_TYPE=postgres # - DB_POSTGRES_HOST=db -- 2.39.5