Reverse proxy and TLS setup

# .env additions
Z4J_DOMAIN=z4j.example.com
Z4J_ACME_EMAIL=you@example.com
Z4J_PUBLIC_URL=https://z4j.example.com

# Bring the stack up with both compose files.
docker compose \
  -f docker-compose.yml \
  -f docker-compose.caddy.yml \
  up -d

{
  email {env.Z4J_ACME_EMAIL}
}

{env.Z4J_DOMAIN} {
  encode zstd gzip
  reverse_proxy z4j-brain:7700
  header {
    Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    X-Content-Type-Options "nosniff"
    X-Frame-Options "DENY"
  }
}

# Add these labels to the z4j-brain service in docker-compose.yml.
# Assumes Traefik is already running with a 'websecure' entrypoint
# and a 'letsencrypt' cert resolver on the same Docker network.
services:
  z4j-brain:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.z4j.rule=Host(`z4j.example.com`)"
      - "traefik.http.routers.z4j.entrypoints=websecure"
      - "traefik.http.routers.z4j.tls.certresolver=letsencrypt"
      - "traefik.http.services.z4j.loadbalancer.server.port=7700"
    networks:
      - traefik_public

# Install cloudflared on the same host as z4j-brain, then:
cloudflared tunnel login
cloudflared tunnel create z4j
cloudflared tunnel route dns z4j z4j.example.com

# Create ~/.cloudflared/config.yml:
cat > ~/.cloudflared/config.yml <<EOF
tunnel: z4j
credentials-file: /root/.cloudflared/<tunnel-uuid>.json
ingress:
  - hostname: z4j.example.com
    service: http://localhost:7700
  - service: http_status:404
EOF

# Run the tunnel (supervise with systemd in production).
cloudflared tunnel run z4j

# /etc/nginx/sites-available/z4j.conf
server {
    listen 443 ssl http2;
    server_name z4j.example.com;

    ssl_certificate     /etc/letsencrypt/live/z4j.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/z4j.example.com/privkey.pem;

    # Required for the agent WebSocket (/ws/agent).
    location / {
        proxy_pass         http://127.0.0.1:7700;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_set_header   Host               $host;
        proxy_set_header   X-Real-IP          $remote_addr;
        proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto  $scheme;

        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

server {
    listen 80;
    server_name z4j.example.com;
    return 301 https://$host$request_uri;
}