Implement a reverse proxy and ensure graceful shutdown of processes

Dockerfile

@@ -1,4 +1,5 @@
 FROM ghcr.io/getalby/hub:v1.8.0 AS builder
+RUN apt update; apt install -y --no-install-recommends caddy
 
 FROM debian:12-slim AS final
 
@@ -10,5 +11,7 @@ COPY --from=builder /usr/lib/nwc/libglalby_bindings.so /usr/lib/nwc/
 COPY --from=builder /usr/lib/nwc/libldk_node.so /usr/lib/nwc/
 COPY --from=builder /bin/main /bin/
 COPY --chmod=755 docker_entrypoint.sh /usr/local/bin/
+COPY --from=builder /usr/bin/caddy /usr/bin/
+RUN mkdir -p /etc/caddy
 
 LABEL maintainer="andrewlunde <[email protected]>"

docker_entrypoint.sh

@@ -102,6 +102,21 @@ export WORK_DIR="/data/albyhub"
 export PORT=8080       #the port on which the app should listen on (default='blah' #8080)
 export LOG_EVENTS=true # makes debugging easier
 
+# Reverse proxy configuration (aka Firefox patch)
+cat  <<EOF >/etc/caddy/Caddyfile
+{
+    admin off
+    servers {
+        protocols h1 h2c h3
+    }
+}
+
+:8443 {
+    tls /mnt/cert/main.cert.pem /mnt/cert/main.key.pem
+    reverse_proxy albyhub.embassy:8080
+}
+EOF
+
 # Output some debug information
 echo "LN Backend Type: $LN_BACKEND_TYPE"
 if [ "$LN_VALUE" = "lnd" ]; then
@@ -110,5 +125,19 @@ if [ "$LN_VALUE" = "lnd" ]; then
     echo "LND Macaroon: $LND_MACAROON_FILE"
 fi
 
-# Start the Alby Hub app
-exec /bin/main
+# Set up a trap to catch INT signal for graceful shutdown and start
+_term() {
+  echo "Caught INT signal!"
+  kill -INT "$alby_process" 2>/dev/null
+  kill -INT "$caddy_process" 2>/dev/null
+}
+
+main &
+alby_process=$!
+
+caddy run --config /etc/caddy/Caddyfile &
+caddy_process=$!
+
+trap _term INT
+
+wait $caddy_process $alby_process

manifest.yaml

@@ -23,6 +23,7 @@ main:
   args: []
   mounts:
     main: /data
+    cert: /mnt/cert
     lnd: /mnt/lnd
 health-checks:
   web-ui:
@@ -39,6 +40,9 @@ environment: ~
 volumes:
   main:
     type: data
+  cert:
+    type: certificate
+    interface-id: main
   lnd:
     type: pointer
     package-id: lnd
@@ -52,6 +56,7 @@ interfaces:
     tor-config:
       port-mapping:
         80: "8080"
+        443: "8443"
     lan-config:
       443:
         ssl: true