From c5699714dc91cca40adf936ebc3d2bafc7697845 Mon Sep 17 00:00:00 2001
From: Kenneth Obsequio <k80308392@gmail.com>
Date: Sat, 29 Aug 2026 16:24:44 +0800
Subject: [PATCH] added Caddyfile

Our favorite hits aside from nginx conf

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>
---
 Caddyfile       | 31 +++++++++++++++++++++++++++++++
 SELF_HOSTING.md | 17 ++++++++++++++---
 2 files changed, 45 insertions(+), 3 deletions(-)
 create mode 100644 Caddyfile

diff --git a/Caddyfile b/Caddyfile
new file mode 100644
index 0000000..dc88cf2
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,31 @@
+# Reverse proxy template for a REAL deployment (real domain + automatic HTTPS).
+# Not needed for local testing against localhost:4650 — this is the step you
+# take once you're actually putting this in front of a public domain.
+#
+# Usage:
+#   1. Point 3 DNS records at this machine: your app domain, your api
+#      subdomain, and your cdn subdomain (matching FRONTEND_URL / APP_URL /
+#      S3_PUBLIC_URL in apps/api/.env and VITE_APP_URL / VITE_API_URL in
+#      apps/web/.env).
+#   2. Install Caddy (https://caddyserver.com/docs/install) directly on this
+#      host — it is NOT part of docker-compose.yml, so it binds host ports
+#      80/443 directly and reverse-proxies to the containers' published
+#      ports below.
+#   3. Copy this file to /etc/caddy/Caddyfile (or wherever your install
+#      expects it), filling in the three domains.
+#   4. sudo systemctl reload caddy   (or: caddy run --config Caddyfile)
+#
+# Caddy issues and renews Let's Encrypt certificates automatically the first
+# time each domain is requested — no manual cert steps needed.
+
+yourdomain.com {
+	reverse_proxy localhost:4650
+}
+
+api.yourdomain.com {
+	reverse_proxy localhost:3024
+}
+
+cdn.yourdomain.com {
+	reverse_proxy localhost:3900
+}
diff --git a/SELF_HOSTING.md b/SELF_HOSTING.md
index 8f2c391..cd7f7bc 100644
--- a/SELF_HOSTING.md
+++ b/SELF_HOSTING.md
@@ -1,14 +1,13 @@
 # Self-Hosting `new_starr` (Docker Compose) — Step-by-Step
 
 This stack bundles everything: PostgreSQL, Valkey (Redis), Garage (S3), the API, and the
-frontend. Battle-tested end-to-end on a completely fresh Debian machine on 2026-08-29 —
+frontend. Battle-tested end-to-end on a completely fresh Debian machine on 2026-08-29 
 every gotcha below actually happened once and is now fixed or documented.
 
 ---
 
 ## 0. What you need
 
-- A Linux machine (Debian/Ubuntu commands below — adapt the package manager for others)
 - Docker Engine + Compose plugin
 - Node.js 22 + pnpm (only needed once, to build the frontend bundle)
 - Git access to this repo
@@ -161,7 +160,19 @@ docker compose ps
 - Frontend: **http://localhost:4650**
 - Backend: http://localhost:3024/api
 
-If both respond, you're done.
+If both respond, you're done with local testing.
+
+---
+
+## 9. (Optional) Put a real domain + HTTPS in front
+
+For actually deploying this somewhere reachable, use the `Caddyfile` at the repo root
+as a template. It's a standalone Caddy install on the host (not part of
+`docker-compose.yml`) that reverse-proxies 3 domains to the 3 ports already published
+above (`:4650`, `:3024`, `:3900`) and handles Let's Encrypt certificates automatically.
+See the comments at the top of `Caddyfile` for exact steps. Not needed for local
+`localhost:4650` testing — skip this until you're pointing a real domain at the
+machine.
 
 ---