Skip to content

Commit 359b436

Browse files
Wayne-JonesWayne-Jones
committed
feat(config): ✨ Add Caddy configuration and environment setup
Introduced a comprehensive Caddy configuration for the Ghost CMS setup, including support for ActivityPub and Traffic Analytics. The new configuration allows for better management of domains, logging, and security headers. - Added Caddyfile and Caddyfile.example for configuration. - Included snippets for logging, security headers, ActivityPub, and Traffic Analytics. - Updated .env-example with new environment variables for configuration. - Created a docker-compose.yml file to manage services and dependencies. This setup enhances the deployment process and improves the overall functionality of the Ghost CMS.
1 parent 54c05a0 commit 359b436

File tree

9 files changed

+459
-2
lines changed

9 files changed

+459
-2
lines changed

‎.env-example‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,63 @@
11
CONTENT_API_KEY=
2-
BLOG_URL=
2+
BLOG_URL=
3+
4+
# Use the below flags to enable the Analytics or ActivityPub containers as well
5+
# COMPOSE_PROFILES=analytics,activitypub
6+
7+
# Ghost domain
8+
# Custom public domain Ghost will run on
9+
DOMAIN=example.com
10+
11+
# Ghost Admin domain
12+
# If you have Ghost Admin setup on a separate domain uncomment the line below and add the domain
13+
# You also need to uncomment the corresponding block in your Caddyfile
14+
# ADMIN_DOMAIN=
15+
16+
# Database settings
17+
# All database settings must not be changed once the database is initialised
18+
DATABASE_ROOT_PASSWORD=reallysecurerootpassword
19+
# DATABASE_USER=optionalusername
20+
DATABASE_PASSWORD=ghostpassword
21+
22+
# ActivityPub
23+
# If you'd prefer to self-host ActivityPub yourself uncomment the line below
24+
# ACTIVITYPUB_TARGET=activitypub:8080
25+
26+
# Tinybird configuration
27+
# If you want to run Analytics, paste the output from `docker compose run --rm tinybird-login get-tokens` below
28+
# TINYBIRD_API_URL=https://api.tinybird.co
29+
# TINYBIRD_TRACKER_TOKEN=p.eyJxxxxx
30+
# TINYBIRD_ADMIN_TOKEN=p.eyJxxxxx
31+
# TINYBIRD_WORKSPACE_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
32+
33+
# Ghost configuration (https://ghost.org/docs/config/)
34+
35+
# SMTP Email (https://ghost.org/docs/config/#mail)
36+
# Transactional email is required for logins, account creation (staff invites), password resets and other features
37+
# This is not related to bulk mail / newsletter sending
38+
mail__transport=SMTP
39+
mail__options__host=smtp.example.com
40+
mail__options__port=465
41+
mail__options__secure=true
42+
mail__options__auth__user=support@example.com
43+
mail__options__auth__pass=1234567890
44+
mail__from="'Acme Support' <support@example.com>"
45+
46+
# Advanced customizations
47+
48+
# Force Ghost version
49+
# You should only do this if you need to pin a specific version
50+
# The update commands won't work
51+
# GHOST_VERSION=6-alpine
52+
53+
# Port Ghost should listen on
54+
# You should only need to edit this if you want to host
55+
# multiple sites on the same server
56+
# GHOST_PORT=2368
57+
58+
# Data locations
59+
# Location to store uploaded data
60+
UPLOAD_LOCATION=./data/ghost
61+
62+
# Location for database data
63+
MYSQL_DATA_LOCATION=./data/mysql

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,7 @@ yarn-error.log*
3737
next-env.d.ts
3838

3939
#copilot
40-
copilot/
40+
copilot/
41+
42+
data/
43+
.pnpm-store/

‎caddy/Caddyfile‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{$DOMAIN} {
2+
import snippets/Logging
3+
4+
# Traffic Analytics service
5+
import snippets/TrafficAnalytics
6+
7+
# ActivityPub Service
8+
import snippets/ActivityPub
9+
10+
# Default proxy everything else to Ghost
11+
handle {
12+
reverse_proxy ghost:2368
13+
}
14+
15+
# Optional: Enable gzip compression
16+
encode gzip
17+
18+
# Optional: Add security headers
19+
import snippets/SecurityHeaders
20+
}
21+
22+
# Separate admin domains
23+
# To use a separate domain for Ghost Admin uncomment the block below (recommended)
24+
# {$ADMIN_DOMAIN} {
25+
# import snippets/Logging
26+
#
27+
# # Traffic Analytics service
28+
# import snippets/TrafficAnalytics
29+
#
30+
# # ActivityPub Service
31+
# import snippets/ActivityPub
32+
#
33+
# # Default proxy everything else to Ghost
34+
# handle {
35+
# reverse_proxy ghost:2368
36+
# }
37+
#
38+
# # Optional: Enable gzip compression
39+
# encode gzip
40+
#
41+
# # Optional: Add security headers
42+
# import snippets/SecurityHeaders
43+
# }
44+
45+
# Redirect www -> root domain
46+
# To redirect the www variant of your domain to the non-www variant uncomment the 4 lines below
47+
# Note: You must have DNS setup correctly for both domains for this to work
48+
# www.{$DOMAIN} {
49+
# import snippets/Logging
50+
# redir https://{$DOMAIN}{uri}
51+
# }
52+
53+
# Redirect root -> www domain
54+
# To redirect the non-www variant of your domain to the www variant uncomment the 4 lines below and change CHANGE_ME to your root domain
55+
# Note: You must have DNS setup correctly for both domains for this to work
56+
# When using ActivityPub with a www. domain, you must enable this redirect for ActivityPub to work correctly
57+
# CHANGE_ME {
58+
# import snippets/Logging
59+
# redir https://{$DOMAIN}{uri}
60+
# }

‎caddy/Caddyfile.example‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{$DOMAIN} {
2+
import snippets/Logging
3+
4+
# Traffic Analytics service
5+
import snippets/TrafficAnalytics
6+
7+
# ActivityPub Service
8+
import snippets/ActivityPub
9+
10+
# Default proxy everything else to Ghost
11+
handle {
12+
reverse_proxy ghost:2368
13+
}
14+
15+
# Optional: Enable gzip compression
16+
encode gzip
17+
18+
# Optional: Add security headers
19+
import snippets/SecurityHeaders
20+
}
21+
22+
# Separate admin domains
23+
# To use a separate domain for Ghost Admin uncomment the block below (recommended)
24+
# {$ADMIN_DOMAIN} {
25+
# import snippets/Logging
26+
#
27+
# # Traffic Analytics service
28+
# import snippets/TrafficAnalytics
29+
#
30+
# # ActivityPub Service
31+
# import snippets/ActivityPub
32+
#
33+
# # Default proxy everything else to Ghost
34+
# handle {
35+
# reverse_proxy ghost:2368
36+
# }
37+
#
38+
# # Optional: Enable gzip compression
39+
# encode gzip
40+
#
41+
# # Optional: Add security headers
42+
# import snippets/SecurityHeaders
43+
# }
44+
45+
# Redirect www -> root domain
46+
# To redirect the www variant of your domain to the non-www variant uncomment the 4 lines below
47+
# Note: You must have DNS setup correctly for both domains for this to work
48+
# www.{$DOMAIN} {
49+
# import snippets/Logging
50+
# redir https://{$DOMAIN}{uri}
51+
# }
52+
53+
# Redirect root -> www domain
54+
# To redirect the non-www variant of your domain to the www variant uncomment the 4 lines below and change CHANGE_ME to your root domain
55+
# Note: You must have DNS setup correctly for both domains for this to work
56+
# When using ActivityPub with a www. domain, you must enable this redirect for ActivityPub to work correctly
57+
# CHANGE_ME {
58+
# import snippets/Logging
59+
# redir https://{$DOMAIN}{uri}
60+
# }

‎caddy/snippets/ActivityPub‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# ActivityPub
2+
# Proxy activitypub requests /.ghost/activitypub/
3+
handle /.ghost/activitypub/* {
4+
reverse_proxy {$ACTIVITYPUB_TARGET}
5+
}
6+
7+
handle /.well-known/webfinger {
8+
reverse_proxy {$ACTIVITYPUB_TARGET}
9+
}
10+
11+
handle /.well-known/nodeinfo {
12+
reverse_proxy {$ACTIVITYPUB_TARGET}
13+
}

‎caddy/snippets/Logging‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Log all requests
2+
log {
3+
output stdout
4+
format console
5+
level INFO
6+
}

‎caddy/snippets/SecurityHeaders‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
header {
2+
# Enable HSTS
3+
Strict-Transport-Security max-age=31536000;
4+
# Enable XSS protection
5+
X-XSS-Protection "1; mode=block"
6+
# Prevent MIME sniffing
7+
X-Content-Type-Options nosniff
8+
# Referrer policy
9+
Referrer-Policy strict-origin-when-cross-origin
10+
# Prevent embedding in external iframes
11+
Content-Security-Policy "frame-ancestors 'self' {$ADMIN_DOMAIN:}"
12+
}

‎caddy/snippets/TrafficAnalytics‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Proxy analytics requests with any prefix (e.g. /.ghost/analytics/ or /blog/.ghost/analytics/)
2+
@analytics_paths path_regexp analytics_match ^(.*)/\.ghost/analytics(.*)$
3+
handle @analytics_paths {
4+
rewrite * {re.analytics_match.2}
5+
reverse_proxy traffic-analytics:3000
6+
}

0 commit comments

Comments
 (0)