Skip to main content

Domain and HTTPS Setup

The supported production Compose deployment uses one public origin. Caddy serves the Nuxt frontend and the frontend proxies GraphQL through /api/graphql, so a separate public backend domain is not required.

DNS​

Point the forum hostname at the production host:

forum.example.com.  A  203.0.113.10

Add an AAAA record only when the host has correctly configured public IPv6. Wait for DNS to resolve before starting Caddy.

Set the hostname and ACME contact in .env.production:

MULTIFORUM_DOMAIN=forum.example.com
CADDY_ACME_EMAIL=admin@example.com

Do not include https://, a path, or a trailing slash in MULTIFORUM_DOMAIN.

Firewall​

Allow:

  • TCP 80 for redirects and normal ACME validation;
  • TCP 443 for HTTPS; and
  • UDP 443 for HTTP/3.

Restrict SSH to trusted administrator addresses. Do not publish frontend, backend, Neo4j Browser, or Bolt ports to the internet. The production Compose overlay binds those diagnostic ports to loopback.

Automatic certificates​

Caddy obtains and renews certificates automatically. You do not need Certbot for the supported production path. Keep port 80 reachable unless you explicitly configure a different Caddy ACME challenge.

Follow Caddy during first startup:

docker compose \
  --env-file .env.production \
  -f docker-compose.yml \
  -f docker-compose.production.yml \
  logs --tail=100 caddy

Then verify the HTTPS origin and security headers:

scripts/verify-self-hosting.sh --env-file .env.production

Auth0 URLs​

For forum.example.com, configure:

  • Callback: https://forum.example.com/auth/callback
  • Logout: https://forum.example.com
  • Web origin: https://forum.example.com

See Auth0 Setup.