Replace Traefik with host-webserver reverse proxy in prod deployment

The production host runs cPanel, which already owns ports 80/443 for other sites on the box -- there's no Traefik there. docker-compose.prod.yml now binds the api container to 127.0.0.1:8000 only; the host's own Apache/LiteSpeed (via cPanel) reverse-proxies api.amdbs.net to it and terminates TLS itself (AutoSSL). Dropped the external traefik-public network requirement and Traefik labels entirely. Also corrected a separate latent inaccuracy while touching this: a bare `docker compose up` (not `docker stack deploy`) never actually honored deploy.replicas -- docs now say so and point at `--scale` instead of implying free multi-replica scaling that was never really happening. README's Production deployment section rewritten with concrete steps: Cloudflare DNS record, cPanel subdomain + reverse proxy, then compose up. Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-09-05 20:49:55 -05:00
parent ec9b1c28e3
commit 905cd202eb
4 changed files with 59 additions and 47 deletions
@@ -198,8 +198,10 @@ of actually ingesting that movie or series, so there's no separate
 ## Administrative (section 17: "separately protected")

 Require header `X-API-Key: <one of AURORA_ADMIN_API_KEYS>`. Never exposed to
-public clients — mount behind a separate Traefik router/ACL in production if
-you want network-level isolation too.
+public clients — add a rule in the host webserver's vhost config for
+`api.amdbs.net` (e.g. an Apache `<Location>`/LiteSpeed rewrite blocking
+`/api/v1/admin/*` from outside a trusted IP range) in production if you
+want network-level isolation on top of the API key.

 | Method | Path | Body | Notes |
 |---|---|---|---|