launching

deploy/README.md

@@ -1,6 +1,8 @@
 # Deploying the backend to a DigitalOcean Droplet
 
-One Droplet runs the API, the job worker, Caddy (automatic HTTPS) and, optionally, the video renderer.
+One Droplet runs the API, the job worker and, optionally, the video renderer. HTTPS comes from the reverse
+proxy already on the Droplet (Nginx, see nginx-notestack.conf), or from the bundled Caddy (`CADDY=1`) on a
+Droplet with nothing else on ports 80 and 443.
 The database is Neon. The frontend is on Cloudflare Pages.
 
 ## First time
@@ -22,6 +24,17 @@ The database is Neon. The frontend is on Cloudflare Pages.
 6. **Google OAuth client**: redirect URI `https://api.notestack.ai/api/auth/google/callback`, JavaScript origin
    `https://notestackai.pages.dev`.
 
+## Sharing the Droplet with other backends (Nginx)
+
+The API listens on `127.0.0.1:8010` only (`API_PORT`). Point Nginx at it:
+
+```bash
+sudo cp /opt/notestack/deploy/nginx-notestack.conf /etc/nginx/sites-available/notestack
+sudo ln -s /etc/nginx/sites-available/notestack /etc/nginx/sites-enabled/notestack
+sudo nginx -t && sudo systemctl reload nginx
+sudo certbot --nginx -d api.notestack.ai
+```
+
 ## Every update
 
 ```bash

deploy/docker-compose.prod.yml

@@ -1,6 +1,7 @@
 # Production stack for a single DigitalOcean Droplet. The database is Neon (DATABASE_URL in .env.prod).
 #   cd /opt/notestack/deploy && docker compose --env-file .env.prod -f docker-compose.prod.yml up -d --build
-# Caddy terminates HTTPS for API_DOMAIN and proxies to the API; the worker and renderer are internal.
+# The API listens on 127.0.0.1:API_PORT (default 8010) for the reverse proxy already on this host (Nginx,
+# Caddy...). On a Droplet with nothing else on ports 80/443, start the bundled Caddy with --profile caddy.
 
 services:
   api:
@@ -12,6 +13,8 @@ services:
     command: >
       sh -c "alembic upgrade head &&
              uvicorn app.main:app --host 0.0.0.0 --port 8000 --proxy-headers --forwarded-allow-ips='*'"
+    ports:
+      - "127.0.0.1:${API_PORT:-8010}:8000" # local only: the host proxy forwards API_DOMAIN here
     volumes:
       - appdata:/data
     healthcheck:
@@ -39,9 +42,10 @@ services:
       INTERNAL_TOKEN: ${INTERNAL_TOKEN} # must match the API's
     profiles: ["render"] # optional: start with --profile render (needs about 2 GB of free RAM)
 
-  caddy:
+  caddy: # only on a Droplet with no other web server: --profile caddy
     image: caddy:2
     restart: unless-stopped
+    profiles: ["caddy"]
     ports:
       - "80:80"
       - "443:443"

deploy/env.prod.example

@@ -3,6 +3,8 @@
 
 # ---- Domains
 API_DOMAIN=api.notestack.ai
+# Local port the host reverse proxy (Nginx) forwards API_DOMAIN to. Change it if 8010 is taken.
+API_PORT=8010
 ACME_EMAIL=arslan@firebird-technologies.com
 ENV=production
 API_URL=https://api.notestack.ai

deploy/nginx-notestack.conf

@@ -0,0 +1,31 @@
+# Nginx site for the Notestack API on a Droplet that already runs other backends.
+#   sudo cp /opt/notestack/deploy/nginx-notestack.conf /etc/nginx/sites-available/notestack
+#   sudo ln -s /etc/nginx/sites-available/notestack /etc/nginx/sites-enabled/notestack
+#   sudo nginx -t && sudo systemctl reload nginx
+#   sudo certbot --nginx -d api.notestack.ai        # adds HTTPS and the 443 server block
+# The API container listens on 127.0.0.1:8010 (API_PORT in deploy/.env.prod).
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name api.notestack.ai;
+
+    # Voice samples, PDFs and other uploads.
+    client_max_body_size 220m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8010;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+
+        # Job progress and chat are server sent events: stream them, do not buffer or time out early.
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}

deploy/update.sh

@@ -2,6 +2,7 @@
 # Deploy the latest code: pull, rebuild, restart, then check health.
 #   bash /opt/notestack/deploy/update.sh            # API, worker, Caddy
 #   RENDER=1 bash /opt/notestack/deploy/update.sh   # also the video renderer
+#   CADDY=1  bash /opt/notestack/deploy/update.sh   # bundled Caddy (only if nothing else uses ports 80/443)
 set -euo pipefail
 
 cd "$(dirname "$0")"
@@ -14,11 +15,22 @@ if grep -qE '=<|<(user|password|ep-xxxx|region|db)>' .env.prod; then
 fi
 
 profile=()
-[ "${RENDER:-0}" = "1" ] && profile=(--profile render)
+[ "${RENDER:-0}" = "1" ] && profile+=(--profile render)
+[ "${CADDY:-0}" = "1" ] && profile+=(--profile caddy)
 
 docker compose --env-file .env.prod -f docker-compose.prod.yml "${profile[@]}" up -d --build --remove-orphans
 docker image prune -f >/dev/null
 
+port=$(grep -E '^API_PORT=' .env.prod | cut -d= -f2)
+port=${port:-8010}
+echo "==> Waiting for the API on 127.0.0.1:$port"
+for _ in $(seq 1 30); do
+  curl -fsS "http://127.0.0.1:$port/api/health" >/dev/null 2>&1 && break
+  sleep 4
+done
+curl -fsS "http://127.0.0.1:$port/api/health" || { echo "API not up. Logs: cd deploy && docker compose --env-file .env.prod -f docker-compose.prod.yml logs -f api"; exit 1; }
+echo
+
 domain=$(grep -E '^API_DOMAIN=' .env.prod | cut -d= -f2)
 echo "==> Waiting for https://$domain/api/health"
 for _ in $(seq 1 30); do