From f0b930ebce023a9476c3052957229947ab25544b Mon Sep 17 00:00:00 2001 From: diyaa Date: Sun, 26 Jul 2026 19:52:43 +0200 Subject: [PATCH] Configure relay for production certificate resolver --- IMPLEMENTATION_STATUS.md | 1 + relay-server/.env.example | 2 ++ relay-server/docker-compose.yml | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/IMPLEMENTATION_STATUS.md b/IMPLEMENTATION_STATUS.md index c7d0495..7401cfc 100644 --- a/IMPLEMENTATION_STATUS.md +++ b/IMPLEMENTATION_STATUS.md @@ -194,6 +194,7 @@ - `relay-server/.env.example` now contains a non-secret placeholder for `ADMIN_TOKEN` instead of a committed credential. Before deployment, generate and set a unique value in the untracked `relay-server/.env` file. - Verified the Docker Compose configuration with the example environment and confirmed a local relay instance responds successfully from `GET /health`. - Extended WebSocket serialization coverage to preserve the sender timestamp used for offline message delivery. +- The relay now defaults to the production Traefik certificate resolver (`myresolver`) and allows a host-specific override through `TRAEFIK_CERT_RESOLVER`. ## Bug Fixes — Post-Review ✅ diff --git a/relay-server/.env.example b/relay-server/.env.example index cb34d60..ae46759 100644 --- a/relay-server/.env.example +++ b/relay-server/.env.example @@ -2,5 +2,7 @@ PORT=3000 MAX_FILE_SIZE_MB=25 UPLOADS_DIR=/data/files FILE_TTL_DAYS=30 +# Must match the certificate resolver configured by the host Traefik instance. +TRAEFIK_CERT_RESOLVER=myresolver # Required for POST /admin/cleanup. Generate a unique value, for example: openssl rand -hex 32 ADMIN_TOKEN=replace-with-a-unique-random-secret diff --git a/relay-server/docker-compose.yml b/relay-server/docker-compose.yml index d6ca630..d9753c3 100644 --- a/relay-server/docker-compose.yml +++ b/relay-server/docker-compose.yml @@ -14,7 +14,7 @@ services: - "traefik.enable=true" - "traefik.http.routers.fchati.rule=Host(`fchati.diyaa.de`)" - "traefik.http.routers.fchati.entrypoints=websecure" - - "traefik.http.routers.fchati.tls.certresolver=letsencrypt" + - "traefik.http.routers.fchati.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-myresolver}" - "traefik.http.services.fchati.loadbalancer.server.port=3000" volumes: