Your working folder with compose.yaml, .env and Caddy

With docker compose you describe all your containers in one file. In this guide, all apps live in the folder /srv/diensten, with Caddy as the front door that handles https for every app. The recipes in chapter 7 each add a little piece to this. To learn how compose and the firewall work together, read Docker compose and the firewall in the VPS and Linux server administration course.

The folder and the files

anna@web1:~$ sudo mkdir -p /srv/diensten
anna@web1:~$ cd /srv/diensten
anna@web1:/srv/diensten$ sudo nano compose.yaml

Start with just Caddy:

services:
  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config

volumes:
  caddy-data:
  caddy-config:

And the Caddyfile in the same folder:

{
	email beheer@example.com
}

A version: line at the top is no longer needed; you will still see it in older examples.

Starting and viewing

anna@web1:/srv/diensten$ sudo docker compose up -d
anna@web1:/srv/diensten$ sudo docker compose ps
anna@web1:/srv/diensten$ sudo docker compose logs -f caddy

up -d starts everything in the background. Press Ctrl+C to stop following the logs; the containers keep running. If you change the Caddyfile, reload it with:

anna@web1:/srv/diensten$ sudo docker compose exec -w /etc/caddy caddy caddy reload

Secrets in .env

Don't put passwords and tokens in compose.yaml. Put them in a .env file in the same folder instead. In compose.yaml you refer to them with ${NAAM}.

anna@web1:/srv/diensten$ sudo nano .env
anna@web1:/srv/diensten$ sudo chmod 600 .env

Never put .env in Git and don't share it.

Is Caddy already running as a service on your server?

If you installed Caddy or nginx as in chapter 5, ports 80 and 443 are already in use. Choose one of two options:

• Turn off the service on the server (sudo systemctl disable --now caddy or nginx) and move your sites to the Caddyfile in /srv/diensten. This is what the recipes assume.
• Or keep the service on the server, leave Caddy out of compose, and publish each app only on 127.0.0.1 (see Docker and the firewall: publishing ports safely). You then set up a reverse proxy for each app as in An app behind a reverse proxy.