jmwilly/caddy-ratelimit repository overview

# Build stage
FROM golang:alpine AS builder

# Install build dependencies: git for fetching modules, build-base for compilation
RUN apk add --no-cache git

# Install xcaddy: tool that builds Caddy with custom plugins
RUN go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest

# Set working directory for better organization
WORKDIR /src-build

# Build Caddy with rate limit module
RUN xcaddy build \
    --with github.com/mholt/caddy-ratelimit@latest \
    --output /usr/local/bin/caddy

# Final stage
FROM alpine:latest

# Install runtime dependencies
RUN apk add --no-cache ca-certificates mailcap

# Create Caddy user for privilege separation
RUN addgroup -S caddy
RUN adduser -S -G caddy caddy

# Copy compiled Caddy binary
COPY --from=builder /usr/local/bin/caddy /usr/local/bin/caddy

# Ownership and permissions
RUN chown caddy:caddy /usr/local/bin/caddy 
RUN chmod 755 /usr/local/bin/caddy

# Create standard directories
RUN mkdir -p /config /data /etc/caddy 
RUN chown -R caddy:caddy /config /data /etc/caddy

# Default Caddyfile for first-time users
COPY <<EOF /etc/caddy/Caddyfile
{
    auto_https off
    admin 0.0.0.0:2019
}
:80 {
    respond "Caddy rate-limited is runnig!"
}
EOF
RUN chown caddy:caddy /etc/caddy/Caddyfile

# Switch to non-root user for security
USER caddy

# Volumes for persistence and configuration
VOLUME ["/data", "/config"]

# Expose ports: 80 (HTTP), 443 (HTTPS), 2019 (Admin API)
EXPOSE 80 443 2019

# Healthcheck for monitoring in containerized environments
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
    CMD wget -qO- http://localhost:80 || exit 1

# Binary path and command
ENTRYPOINT ["/usr/local/bin/caddy"]
CMD ["run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]