WebHosting/README.md

WebHosting

Shared web applications behind Nginx/Apache, deployed in /opt/WebHosting.

• docker-compose.yaml combines stacks/<app>/compose.yaml into one Compose project. Run commands from the repository root; relative paths resolve from there.
• Only Nginx publishes host ports (80/443) and joins public and backend. Web applications share backend; databases use their separate application networks. These are bridge networks with outbound access, without internal: true.
• Puppet manages secrets through hiera/data-lx/default/lx-docker-01.psi.ch.yaml. The service env files live under /etc/webhosting/, separately from this repo.
• Env files are root-owned (0600, directories 0700) and use format: raw: keep values literal, without adding quotes or escaping dollar signs.

Puppet must provision all required env files before Compose validation or deployment. Use config --quiet to avoid printing secrets. After an update, check the application; if its container IP changed, validate and reload Nginx using the host's deployment procedure.

Gitea Actions runs linting and Compose syntax checks for PRs. After a merge to main, it pulls the repo, obtains missing certificates, runs Compose, and tests/reloads Nginx. Failed commands stop the job; there is no automatic rollback.

For new sites, use /etc/nginx/certs/<hostname>.crt and /etc/nginx/private/<hostname>.key in the Nginx config. CI checks the host's /etc/letsencrypt/live/<hostname>/ for fullchain.pem and privkey.pem, requesting a certificate if either is missing. It uses the existing host ACME config and ensures symlinks under /etc/pki/tls/, mounted at those Nginx paths in the container. It reloads Nginx at the end. Existing certificates keep their normal renewal schedule.