julian
c87dcb2253
In prod the containerized server sat on the Docker bridge (172.18.0.x) and could
only see eth0 — so the setup backend-IP picker (net.ts networkInterfaces) showed
just the Docker IP, the server couldn't reach the relay or fetch Hikvision ISAPI
snapshots, and push devices (readers/cameras) couldn't reach it. The server is the
ONLY container doing device I/O, so put it on the HOST network namespace.
- docker-compose.prod.yml: server + proxy → network_mode: host (server detaches the
base `parking` network via `networks: !reset []`). server VISION_URL=127.0.0.1:8089.
vision stays BRIDGED (it never touches a device — the server hands it JPEG bytes)
but publishes 8089 on 127.0.0.1 only, so the host-net server reaches it over
loopback while the ANPR service stays off the LAN.
- docker-compose.yml: VISION_URL is now ${VISION_URL:-http://vision:8089} so dev keeps
compose-DNS service-name routing; prod overrides to loopback.
- Caddyfile: reverse_proxy 127.0.0.1:3000 (was server:3000 — service DNS doesn't
resolve on host net). Dev doesn't use Caddy, so unaffected.
Merge validated for both envs (booth.sh config, exit 0). Host-net side effect: the
container ping_group_range sysctl is a no-op — the HOST must set it for reader ICMP
liveness (see appliance-provisioning).
Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
16 lines
893 B
Caddyfile
16 lines
893 B
Caddyfile
# Booth reverse proxy. `:80` matches ANY hostname/IP, so the booth is reachable as
|
|
# http://<booth-ip>/, http://localhost/, or http://parksystems.msai.al/ (the name pointed
|
|
# at the booth's IP via hosts/DNS on-site) — with no domain baked into any image. The SPA
|
|
# uses a relative /api base, so everything (HTTP + the /api/ws WebSocket, which Caddy
|
|
# upgrades automatically) just flows through to the server container.
|
|
#
|
|
# TLS later: replace `:80` with the real hostname (e.g. `parksystems.msai.al`), uncomment
|
|
# Caddy's :443 in docker-compose.prod.yml, and Caddy auto-provisions HTTPS. For a private
|
|
# CA / internal cert, use `tls /path/cert.pem /path/key.pem`.
|
|
:80 {
|
|
encode gzip
|
|
# Host network (prod): the server runs on the host's net namespace (to reach the booth LAN /
|
|
# device VLAN), so reach it over loopback, not the compose service name `server`.
|
|
reverse_proxy 127.0.0.1:3000
|
|
}
|