cesnimda
c877c61e3e
- site nginx listens on 1337; proxies /api/contact to the relay over the internal
network (single public port; TLS terminates upstream at Cloudflare)
- trailing-slash rewrite moved inside location / so /api/contact isn't redirected
- compose: publish ${SITE_PORT:-1337}, internal bridge network, no Traefik labels
(non-destructive — does not touch the WordPress apex router)
- .gitea/workflows/deploy.yml: on push to main, runner rebuilds + restarts the stack
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
767 B
Bash
20 lines
767 B
Bash
# Copy to .env and fill in. Secrets never go in git or in the image (DOCKER_SPEC §3).
|
|
|
|
# --- Contact relay: SMTP (submission endpoint of your mail provider) ---
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASSWORD= # secret — provide via env file (chmod 600) or a Docker secret
|
|
RELAY_FROM= # optional From address; defaults to SMTP_USER / RELAY_TO
|
|
RELAY_TO=connor.babbington@cesnimda.co.uk
|
|
RELAY_ALLOWED_ORIGIN=https://cesnimda.co.uk
|
|
RELAY_RATE_LIMIT=5 # requests per window per IP
|
|
RELAY_WINDOW_SECONDS=600
|
|
|
|
# --- Site build ---
|
|
PUBLIC_SITE_URL=https://cesnimda.co.uk
|
|
|
|
# --- Infra ---
|
|
SITE_PORT=1337 # host port the public-facing site is published on
|
|
# (put Cloudflare / your TLS proxy in front of it)
|