swadhinbiswas feat: implement air-gapped mode, UI fixes, and project management integrations · 7/9/2026
e3bd4a1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
# OpenCodeHub Production Reverse Proxy
# Caddy auto-provisions TLS certificates via Let's Encrypt
# Usage: Place this in /etc/caddy/Caddyfile or mount into the container
# Replace with your actual domain
opencodehub.example.com {
# Auto HTTPS with Let's Encrypt
tls [email protected]
# Security headers
header {
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
X-Content-Type-Options "nosniff"
X-Frame-Options "DENY"
X-XSS-Protection "1; mode=block"
Referrer-Policy "strict-origin-when-cross-origin"
Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
-Server
-X-Powered-By
}
# Request body size limit (10MB default, git push needs more)
request_body {
max_size 50MB
}
# Proxy to OpenCodeHub app
reverse_proxy app:4321 {
# Health check the upstream
health_uri /api/health
health_interval 30s
health_timeout 10s
# Pass real client info
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
# Timeouts
transport http {
dial_timeout 10s
response_header_timeout 300s
read_timeout 300s
write_timeout 300s
}
}
# Git smart HTTP endpoint — larger timeouts for push/pull
handle_path /git/* {
reverse_proxy app:4321 {
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
transport http {
dial_timeout 10s
response_header_timeout 600s
read_timeout 600s
write_timeout 600s
}
}
}
# Git LFS endpoints
handle_path /info/* {
reverse_proxy app:4321 {
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
transport http {
dial_timeout 10s
response_header_timeout 600s
read_timeout 600s
write_timeout 600s
}
}
}
# Prometheus metrics — restrict to internal network
handle /api/metrics {
# Only allow from localhost/monitoring
remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 {
not remote_ip 0.0.0.0/0
}
reverse_proxy app:4321
}
# Health check endpoint — public
handle /api/health {
reverse_proxy app:4321
}
# Logging
log {
output file /var/log/caddy/access.log {
roll_size 100mb
roll_keep 10
}
format json
}
}
# Metrics-only listener (internal network)
:9090 {
metrics
}