tben
e859bab294
The installer generates a CA and a 397-day certificate into $COBBLE_HOME/certs (in the app image, with the host's addresses), mounts the certificate, key and CA into the container and serves TLS from Bun on the published port. --no-https opts out; --https-cert/--https-key use a real certificate, --https-host adds names and --https-regen replaces the CA. The installer and the image health check use curl -k when TLS is on. The CA is served at /ca.crt and as an iOS/macOS profile at /ca.mobileconfig for one-tap install. Development picks up certs/ automatically, `bun run dev:phone` generates and starts, and a plain-HTTP listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale dev server fails instead of silently answering on the same port.
20 lines
223 B
Plaintext
20 lines
223 B
Plaintext
# Secrets are passed at runtime with `docker run --env-file`, never baked in
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
secrets
|
|
|
|
node_modules
|
|
.git
|
|
.data
|
|
.bunext
|
|
.bun-sqlite
|
|
certs
|
|
db/cobble
|
|
db/.backups
|
|
db/.exports
|
|
coverage
|
|
logs
|
|
*.log
|
|
assets
|