Claude/instatic dokploy deploy keoy18 - #274
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b21cc12f6c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| UPLOADS_DIR: /app/uploads | ||
| STATIC_DIR: /app/dist | ||
| INSTATIC_SECRET_KEY: ${INSTATIC_SECRET_KEY:-} | ||
| PUBLIC_ORIGIN: ${PUBLIC_ORIGIN:-} |
There was a problem hiding this comment.
When this compose file is launched through Dokploy's HTTPS/Traefik route without manually defining PUBLIC_ORIGIN, this default expands to an empty value. Instatic deliberately ignores forwarded scheme headers and falls back to the plain-HTTP request URL (server/auth/security.ts:88-94), so a browser origin such as https://cms.example.com does not match the server's expected http://cms.example.com; first-run setup, login, and other state-changing requests are consequently rejected as an invalid origin, and session cookies also lack Secure. Make the public HTTPS origin required rather than silently accepting an empty value.
Useful? React with 👍 / 👎.
| # Single-file Docker Compose for deploying Instatic on Dokploy (SQLite mode). | ||
| # | ||
| # Dokploy's Compose app type wants one compose file, but the VPS guide | ||
| # (docs/deployment/vps.md) splits SQLite setup across two files | ||
| # (compose.prod.yml + compose.sqlite.yml). This file merges those into one | ||
| # so it can be pointed at directly from the Dokploy UI. |
There was a problem hiding this comment.
Add this deployment method to the deployment documentation, including the Dokploy setup steps and required PUBLIC_ORIGIN/secret configuration. The new file is not referenced anywhere under docs/deployment/, leaving operators with only a compose file whose optional-looking defaults are insufficient for the normal proxied HTTPS deployment; repository rules explicitly require documentation to be updated when deployment configuration changes.
AGENTS.md reference: AGENTS.md:L292-L293
Useful? React with 👍 / 👎.
| STATIC_DIR: /app/dist | ||
| INSTATIC_SECRET_KEY: ${INSTATIC_SECRET_KEY:-} | ||
| PUBLIC_ORIGIN: ${PUBLIC_ORIGIN:-} | ||
| TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-} |
There was a problem hiding this comment.
Under the intended Traefik-routed deployment, leaving TRUSTED_PROXY_CIDRS empty makes clientIp() ignore X-Forwarded-For and return Traefik's socket address for every visitor (server/auth/security.ts:327-340). All users then share the same per-IP login and MFA rate-limit buckets, so 30 login attempts or 10 MFA attempts through the proxy can temporarily block every legitimate administrator and audit records contain only the proxy address. Supply or require the Dokploy proxy network's trusted CIDR while ensuring the application is not directly exposed.
Useful? React with 👍 / 👎.
| ports: | ||
| - "${HOST_PORT:-3001}:3001" |
There was a problem hiding this comment.
Because the service is already attached to dokploy-network for Traefik routing, publishing 3001 on every host interface is unnecessary and bypasses Dokploy's TLS/proxy boundary. With the default HOST_PORT, the deployment also fails whenever another stack already owns host port 3001, which is especially likely on a multi-application Dokploy host. Keep port 3001 container-internal for Traefik instead of publishing it on the VPS.
Useful? React with 👍 / 👎.
2 participants
Summary
Describe the change and why it is needed.
Verification
bun run buildbun testbun run lintChecklist