# Alternate internet-facing self-host recipe. It keeps workerd off the host

# network and places nginx in front for TLS termination and abuse throttling.

#

# docker compose -f docker-compose.proxy.yml up -d

#

# The nginx config lives at deploy/nginx/ethercalc.conf. For production HTTPS:

# place certificates under deploy/nginx/certs/, uncomment the 443 listener in

# that config, AND uncomment the 443 ports mapping on the proxy service below

# — or adapt the same upstream/limit rules to your existing edge.

services:

ethercalc:

build:

context: .

dockerfile: Dockerfile

image: ethercalc:selfhost

restart: unless-stopped

read_only: true

security_opt:

- no-new-privileges:true

tmpfs:

- /tmp:size=64m,mode=1777

expose:

- "8000"

volumes:

- ./ethercalc-data:/data

environment:

ETHERCALC_PORT: "${ETHERCALC_PORT:-8000}"

ETHERCALC_HOST: "0.0.0.0"

ETHERCALC_KEY: "${ETHERCALC_KEY:-}"

ETHERCALC_DISABLE_ROOM_INDEX: "${ETHERCALC_DISABLE_ROOM_INDEX:-1}"

ETHERCALC_CORS: "${ETHERCALC_CORS:-}"

# No ETHERCALC_BASEPATH here on purpose: the bundled nginx config

# proxies at the URL root and does not strip a prefix, so setting a

# basepath behind it produces broken links.

ETHERCALC_EXPIRE: "${ETHERCALC_EXPIRE:-2592000}"

ETHERCALC_ROOM_CREATE_LIMIT: "${ETHERCALC_ROOM_CREATE_LIMIT:-1}"

ETHERCALC_MIGRATE_TOKEN: "${ETHERCALC_MIGRATE_TOKEN:-}"

# Passkey trust anchors. All four must be set together; the public

# origin must be the HTTPS URL users actually visit through this proxy.

ETHERCALC_AUTH: "${ETHERCALC_AUTH:-}"

ETHERCALC_RP_ID: "${ETHERCALC_RP_ID:-}"

ETHERCALC_RP_NAME: "${ETHERCALC_RP_NAME:-}"

ETHERCALC_ORIGIN: "${ETHERCALC_ORIGIN:-}"

healthcheck:

test: ["CMD-SHELL", "curl -fsS http://localhost:8000/_health >/dev/null || exit 1"]

interval: 2s

timeout: 2s

retries: 60

start_period: 5s

proxy:

image: nginx:1.27-alpine

restart: unless-stopped

read_only: true

security_opt:

- no-new-privileges:true

tmpfs:

- /var/cache/nginx:size=64m

- /var/run:size=1m

- /tmp:size=16m,mode=1777

depends_on:

ethercalc:

condition: service_healthy

ports:

- "${ETHERCALC_PROXY_HTTP_PORT:-80}:80"

# Uncomment for HTTPS (together with the 443 listener in

# deploy/nginx/ethercalc.conf and certs in deploy/nginx/certs/):

# - "${ETHERCALC_PROXY_HTTPS_PORT:-443}:443"

volumes:

- ./deploy/nginx/ethercalc.conf:/etc/nginx/conf.d/default.conf:ro

- ./deploy/nginx/certs:/etc/nginx/certs:ro