Mount Caddy's folder so a deploy's Caddyfile reaches it

.github/workflows/ci.yml

@@ -98,9 +98,9 @@ jobs:
           docker run --rm -v "$PWD":/work -w /work hashicorp/terraform:1.16.5 validate
 
   monitoring:
-    # The monitoring configuration (deploy/): Prometheus' config and alert rules (and their
-    # unit tests), Alertmanager's config and the Grafana dashboard, checked by the tools
-    # that read them.
+    # The server's configuration (deploy/): Prometheus' config and alert rules (and their
+    # unit tests), Alertmanager's config, the Grafana dashboard and the Caddyfile, checked
+    # by the tools that read them.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -115,6 +115,8 @@ jobs:
           docker run --rm -v "$PWD/prometheus":/etc/prometheus --entrypoint promtool "$prometheus" test rules /etc/prometheus/alerts.test.yml
           docker run --rm -v "$PWD/alertmanager":/etc/alertmanager --entrypoint amtool "$alertmanager" check-config /etc/alertmanager/alertmanager.yml
           python3 -m json.tool grafana/dashboards/extpulse.json > /dev/null
+          caddy=$(grep -o 'image: caddy:[^ ]*' compose.yaml | cut -d' ' -f2)
+          docker run --rm -e EXTPULSE_DOMAIN=extpulse.example.com -v "$PWD/caddy":/etc/caddy:ro "$caddy" caddy validate --config /etc/caddy/Caddyfile
 
   image:
     # The production image. Built on an Arm runner, natively, because the server
@@ -243,7 +245,7 @@ jobs:
       - name: Deploy
         run: |
           # The files and folders of deploy/, as one archive over the same SSH connection.
-          tar -C deploy -czf - compose.yaml Caddyfile backup.sh offsite.sh deploy.sh prometheus alertmanager grafana \
+          tar -C deploy -czf - compose.yaml caddy backup.sh offsite.sh deploy.sh prometheus alertmanager grafana \
             | ssh -o StrictHostKeyChecking=yes "deploy@${DEPLOY_HOST}" tar -xzf - -C /opt/extpulse
           ssh -o StrictHostKeyChecking=yes "deploy@${DEPLOY_HOST}" bash /opt/extpulse/deploy.sh "sha-${GITHUB_SHA::7}"
 

deploy/README.md

@@ -6,7 +6,7 @@ this way: [ADR 0014](../docs/decisions/0014-deploy-and-operations.md).
 | File | What it does |
 | --- | --- |
 | `compose.yaml` | The app, PostgreSQL, Caddy (HTTPS) and the daily backup |
-| `Caddyfile` | HTTPS for the domain, security headers, proxy to the app |
+| `caddy/Caddyfile` | HTTPS for the domain, security headers, proxy to the app |
 | `deploy.sh` | Starts one image tag, waits for it to be healthy, rolls back if not |
 | `backup.sh` | `pg_dump` every day at 03:00 UTC, keeping 14 days |
 | `offsite.sh` | Copies the dumps to Object Storage, off the server, at 03:30 UTC |

deploy/compose.yaml

@@ -92,7 +92,10 @@ services:
     environment:
       EXTPULSE_DOMAIN: ${EXTPULSE_DOMAIN:-extpulse.mccprogrammer.com}
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      # The folder, not the file: a deploy replaces the Caddyfile with a new file, and a
+      # container keeps seeing the old one through a single-file mount, so the reload
+      # would read the old configuration.
+      - ./caddy:/etc/caddy:ro
       - caddy-data:/data
       - caddy-config:/config
     mem_limit: 128m

deploy/deploy.sh

@@ -36,8 +36,9 @@ up() {
 	docker compose pull --quiet app
 	docker compose up -d --remove-orphans
 	# Compose recreates a service when its definition changes, not when a mounted file
-	# does: pick up the Caddyfile (a reload, without dropping connections), backup.sh,
-	# offsite.sh and the monitoring configuration.
+	# does: pick up the Caddyfile (a reload, without dropping connections; Caddy mounts its
+	# folder, which shows the new file), backup.sh, offsite.sh and the monitoring
+	# configuration (restarts, which mount the new files).
 	docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile >/dev/null
 	docker compose restart backup offsite prometheus alertmanager grafana >/dev/null
 }