Expose staging port to reverse proxy

2026-07-26 10:42:01 -04:00
parent f5eb2fd663
commit 75faef50b8
2 changed files with 6 additions and 3 deletions
@@ -25,7 +25,7 @@ database.
 Staging defaults to:

 - Public origin: `https://stage.shd.build`
- Reverse-proxy upstream: `http://127.0.0.1:5569`
+- Reverse-proxy upstream: host port `5569`
 - Database: `/app/data/shd-build-staging.db`
 - Passkey relying-party ID: `shd.build`
 - Adapter canonical origin: `https://stage.shd.build`
@@ -41,7 +41,10 @@ npm run env:encrypt:staging
 Add `https://stage.shd.build/auth/discord/callback` to the Discord application's
 allowed OAuth redirect URIs. Point the staging DNS record at the deployment
 host and configure the host's TLS reverse proxy to forward
-`stage.shd.build` to `127.0.0.1:5569`.
+`stage.shd.build` to port `5569` on the staging host. Docker publishes this
+port on the host interfaces so a containerized reverse proxy or tunnel can
+reach it; firewall the port to trusted LAN/tunnel sources when the host is
+reachable from other networks.

 The deployment decrypts `.env.staging` on the trusted staging runner into a
 mode-`0600` runtime file. The decryption key is held by Gitea Actions, not