From 75faef50b8b48e19afe022b1bf50c04f72cdcecb Mon Sep 17 00:00:00 2001 From: JB Date: Sun, 26 Jul 2026 10:42:01 -0400 Subject: [PATCH] Expose staging port to reverse proxy --- deploy/compose.staging.yml | 2 +- docs/DEPLOYMENT.md | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/deploy/compose.staging.yml b/deploy/compose.staging.yml index 0d1b327..e95c53f 100644 --- a/deploy/compose.staging.yml +++ b/deploy/compose.staging.yml @@ -16,7 +16,7 @@ services: TDR_AVATAR_STORAGE_PATH: /app/data/avatars TDR_GAME_ICON_STORAGE_PATH: /app/data/game-icons ports: - - "127.0.0.1:${SHD_STAGE_PORT:-5569}:3000" + - "0.0.0.0:${SHD_STAGE_PORT:-5569}:3000" volumes: - shd_stage_data:/app/data healthcheck: diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md index 2f4209c..a265107 100644 --- a/docs/DEPLOYMENT.md +++ b/docs/DEPLOYMENT.md @@ -25,7 +25,7 @@ database. Staging defaults to: - Public origin: `https://stage.shd.build` -- Reverse-proxy upstream: `http://127.0.0.1:5569` +- Reverse-proxy upstream: host port `5569` - Database: `/app/data/shd-build-staging.db` - Passkey relying-party ID: `shd.build` - Adapter canonical origin: `https://stage.shd.build` @@ -41,7 +41,10 @@ npm run env:encrypt:staging Add `https://stage.shd.build/auth/discord/callback` to the Discord application's allowed OAuth redirect URIs. Point the staging DNS record at the deployment host and configure the host's TLS reverse proxy to forward -`stage.shd.build` to `127.0.0.1:5569`. +`stage.shd.build` to port `5569` on the staging host. Docker publishes this +port on the host interfaces so a containerized reverse proxy or tunnel can +reach it; firewall the port to trusted LAN/tunnel sources when the host is +reachable from other networks. The deployment decrypts `.env.staging` on the trusted staging runner into a mode-`0600` runtime file. The decryption key is held by Gitea Actions, not