From 0e50ec1ac771956d6d30f169c1977b30aeb9dda1 Mon Sep 17 00:00:00 2001
From: chris <chris@chrisedwards.tech>
Date: Mon, 5 Oct 2026 23:02:52 -0400
Subject: [PATCH] Deploy behind an existing reverse proxy

docker-compose.behind-proxy.yml skips Caddy and publishes only the web app
and API on localhost, for a proxy like NPMplus that already owns 80/443.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8
---
 deploy/production.env.example   |  7 +++++++
 docker-compose.behind-proxy.yml | 22 ++++++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 docker-compose.behind-proxy.yml

diff --git a/deploy/production.env.example b/deploy/production.env.example
index 8b4a05a..1959c17 100644
--- a/deploy/production.env.example
+++ b/deploy/production.env.example
@@ -26,3 +26,10 @@ SMTP_PORT=465
 SMTP_USER=
 SMTP_PASSWORD=
 MAIL_FROM=musicshare <app@musicshare.binarygnome.com>
+
+# Only with docker-compose.behind-proxy.yml (an existing proxy like NPMplus owns 80/443):
+# the ports the proxy forwards to. Use 127.0.0.1 if the proxy runs with host networking,
+# otherwise this server's LAN IP.
+PROXY_BIND=127.0.0.1
+WEB_PORT=3737
+API_PORT=3738
diff --git a/docker-compose.behind-proxy.yml b/docker-compose.behind-proxy.yml
new file mode 100644
index 0000000..fa44eec
--- /dev/null
+++ b/docker-compose.behind-proxy.yml
@@ -0,0 +1,22 @@
+# Production behind an existing reverse proxy (e.g. NPMplus / Nginx Proxy Manager)
+# that owns ports 80/443 and handles HTTPS. No Caddy: the web app and API are
+# published on the host for the proxy to reach.
+#
+#   docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.behind-proxy.yml \
+#     --env-file deploy/production.env up -d --build
+#
+# In the proxy, for your domain:
+#   /        -> http://127.0.0.1:3737   (WEB_PORT)
+#   /api/    -> http://127.0.0.1:3738/  (API_PORT; strip the /api prefix, websockets on)
+
+services:
+  caddy:
+    profiles: ["caddy"] # not started
+
+  web:
+    ports: !override
+      - "${PROXY_BIND:-127.0.0.1}:${WEB_PORT:-3737}:3737"
+
+  api:
+    ports: !override
+      - "${PROXY_BIND:-127.0.0.1}:${API_PORT:-3738}:4000"