From fea8a7e0b59b8867f73710765af0dcb739b18c29 Mon Sep 17 00:00:00 2001
From: you <you@example.com>
Date: Fri, 20 Mar 2026 06:07:38 +0000
Subject: [PATCH] =?UTF-8?q?feat:=20add=20Caddy=20to=20Docker=20container?=
 =?UTF-8?q?=20=E2=80=94=20automatic=20HTTPS?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Caddy reverse proxies :80/:443 → Node :3000
- Mount custom Caddyfile for your domain → auto Let's Encrypt TLS
- Caddy certs persisted in /data/caddy volume
- Ports: 80 (HTTP), 443 (HTTPS), 1883 (MQTT)
---
 Dockerfile              | 13 +++++++------
 README.md               | 24 ++++++++++++++++++++++--
 docker/Caddyfile        | 11 +++++++++++
 docker/supervisord.conf |  9 +++++++++
 4 files changed, 49 insertions(+), 8 deletions(-)
 create mode 100644 docker/Caddyfile

diff --git a/Dockerfile b/Dockerfile
index dc2f3d31..a843aef8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 FROM node:22-alpine
 
-RUN apk add --no-cache mosquitto mosquitto-clients supervisor
+RUN apk add --no-cache mosquitto mosquitto-clients supervisor caddy
 
 WORKDIR /app
 
@@ -12,12 +12,13 @@ RUN npm ci --production
 COPY server.js db.js packet-store.js config.example.json ./
 COPY public/ ./public/
 
-# Supervisor config
+# Supervisor + Mosquitto + Caddy config
 COPY docker/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 COPY docker/mosquitto.conf /etc/mosquitto/mosquitto.conf
+COPY docker/Caddyfile /etc/caddy/Caddyfile
 
-# Create data directory for SQLite + Mosquitto persistence
-RUN mkdir -p /app/data /var/lib/mosquitto && \
+# Create data directory for SQLite + Mosquitto persistence + Caddy certs
+RUN mkdir -p /app/data /var/lib/mosquitto /data/caddy && \
     chown -R node:node /app/data && \
     chown -R mosquitto:mosquitto /var/lib/mosquitto
 
@@ -25,8 +26,8 @@ RUN mkdir -p /app/data /var/lib/mosquitto && \
 COPY docker/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
-EXPOSE 3000 1883
+EXPOSE 80 443 1883
 
-VOLUME ["/app/data"]
+VOLUME ["/app/data", "/data/caddy"]
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/README.md b/README.md
index 6bf77f04..8909a3df 100644
--- a/README.md
+++ b/README.md
@@ -77,13 +77,33 @@ The easiest way to run MeshCore Analyzer. Includes Mosquitto MQTT broker — eve
 docker build -t meshcore-analyzer .
 docker run -d \
   --name meshcore-analyzer \
-  -p 3000:3000 \
+  -p 80:80 \
+  -p 443:443 \
   -p 1883:1883 \
   -v meshcore-data:/app/data \
+  -v caddy-certs:/data/caddy \
   meshcore-analyzer
 ```
 
-Open `http://localhost:3000`. Point your MeshCore gateway's MQTT to `<host-ip>:1883`.
+Open `http://localhost`. Point your MeshCore gateway's MQTT to `<host-ip>:1883`.
+
+**With a domain (automatic HTTPS):**
+```bash
+# Create a Caddyfile with your domain
+echo 'analyzer.example.com { reverse_proxy localhost:3000 }' > Caddyfile
+
+docker run -d \
+  --name meshcore-analyzer \
+  -p 80:80 \
+  -p 443:443 \
+  -p 1883:1883 \
+  -v meshcore-data:/app/data \
+  -v caddy-certs:/data/caddy \
+  -v $(pwd)/Caddyfile:/etc/caddy/Caddyfile \
+  meshcore-analyzer
+```
+
+Caddy automatically provisions Let's Encrypt TLS certificates.
 
 **Custom config:**
 ```bash
diff --git a/docker/Caddyfile b/docker/Caddyfile
new file mode 100644
index 00000000..9507b925
--- /dev/null
+++ b/docker/Caddyfile
@@ -0,0 +1,11 @@
+# Default Caddyfile — reverse proxy to Node app
+# Override by mounting your own: -v ./Caddyfile:/etc/caddy/Caddyfile
+#
+# For automatic HTTPS, replace :80 with your domain:
+#   analyzer.example.com {
+#       reverse_proxy localhost:3000
+#   }
+
+:80 {
+    reverse_proxy localhost:3000
+}
diff --git a/docker/supervisord.conf b/docker/supervisord.conf
index 06ac4746..75303377 100644
--- a/docker/supervisord.conf
+++ b/docker/supervisord.conf
@@ -24,3 +24,12 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 environment=NODE_ENV="production"
+
+[program:caddy]
+command=/usr/sbin/caddy run --config /etc/caddy/Caddyfile
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0