mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
Ruben Fiszel
4d0dee8d39
Follow-up to GIT-903 / PR #10106. That PR migrated the caddy-l4 image to mholt's native `layer4` Caddyfile support, which required bumping the Caddy base image to 2.11.4. End-to-end testing (running the image and proxying real traffic, not just `caddy adapt`) revealed that caddy >= 2.9 changed how `bind` treats an empty argument. The shipped Caddyfile has `bind {$ADDRESS}` inside the `{$BASE_URL}` site, and docker-compose leaves ADDRESS unset -- the default self-host case. On 2.11.4 the empty `bind` makes Caddy drop the entire `{$BASE_URL}` site, so the container listens only on :25 (layer4) and the :80 HTTP reverse proxy to windmill_server silently disappears. config-only checks (adapt/validate/boot) pass, so only real traffic surfaces it. Fix in the Caddyfile rather than downgrading Caddy (which would reintroduce known CVEs on an internet-facing proxy): default the bind to all interfaces when ADDRESS is unset via `bind {$ADDRESS:0.0.0.0 ::}`. When ADDRESS is set it is honored unchanged; when unset the site binds IPv4 + IPv6, matching the pre-2.9 behavior. Verified on the caddy:2.11.4 image with a mock windmill_server backend (HTTP :8000 + layer4 echo :2525): - ADDRESS unset -> :80 and :25 both bind; HTTP and layer4 both proxy - ADDRESS=0.0.0.0 -> same - ADDRESS=127.0.0.1 -> HTTP site binds 127.0.0.1:80 (knob preserved) Fixes GIT-903 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
31 lines
867 B
Caddyfile
31 lines
867 B
Caddyfile
{
|
|
layer4 {
|
|
:25 {
|
|
route {
|
|
proxy {
|
|
upstream windmill_server:2525
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
{$BASE_URL} {
|
|
# Default to all interfaces (IPv4 + IPv6) when ADDRESS is unset. A bare
|
|
# `bind {$ADDRESS}` with an empty value makes Caddy >= 2.9 drop this whole
|
|
# site, silently disabling the HTTP proxy while the :25 layer4 listener stays up.
|
|
bind {$ADDRESS:0.0.0.0 ::}
|
|
|
|
# Extra services: LSP, Multiplayer, Debugger (windmill_extra gateway)
|
|
reverse_proxy /ws/* /ws_mp/* /ws_debug/* http://windmill_extra:3000
|
|
|
|
# Search indexer, Enterprise Edition (windmill_indexer:8002)
|
|
# reverse_proxy /api/srch/* http://windmill_indexer:8002
|
|
|
|
# Default: Windmill server
|
|
reverse_proxy /* http://windmill_server:8000
|
|
|
|
# TLS with custom certificates
|
|
# tls /certs/cert.pem /certs/key.pem
|
|
}
|