be60f6ccbc
Two-container deploy: Caddy terminates TLS (auto-provisions Let's Encrypt via ACME) and reverse-proxies to a Numa relay on an internal Docker network. The relay never reads sealed payloads; Caddy's access log is discarded so per-request observability doesn't defeat the oblivious property. Validated against Hetzner CX22 + DNS at odoh-relay.numa.rs: - TLS-ALPN-01 challenge succeeded on first attempt - /health returned the relay's counter block - End-to-end ODoH client → relay → Cloudflare works Operators only need to: set a DNS A record, edit Caddyfile's hostname, docker compose up -d. README walks through the steps and the DNSCrypt v3/odoh-relays.md submission to claim a public listing.
27 lines
494 B
YAML
27 lines
494 B
YAML
services:
|
|
numa-relay:
|
|
image: ghcr.io/razvandimescu/numa:latest
|
|
command: ["relay", "8443", "0.0.0.0"]
|
|
restart: unless-stopped
|
|
networks: [internal]
|
|
|
|
caddy:
|
|
image: caddy:2
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy_data:/data
|
|
- caddy_config:/config
|
|
restart: unless-stopped
|
|
depends_on: [numa-relay]
|
|
networks: [internal]
|
|
|
|
networks:
|
|
internal:
|
|
|
|
volumes:
|
|
caddy_data:
|
|
caddy_config:
|