commit e207380542fd50dec0e3b5f09d558835b05ccd2d
Author: Beda Schmid <beda@tukutoi.com>
Date:   Mon Aug 31 19:27:53 2026 +0000

    Reset history to current sanitized state

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..a36ad05
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+# BEGIN reset-history environment exclusions
+.env
+.env.*
+*.env
+*.env.*
+!.env.example
+!.env.*.example
+!*.env.example
+!*.env.*.example
+# END reset-history environment exclusions
diff --git a/Caddyfile b/Caddyfile
new file mode 100644
index 0000000..2c45861
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,10 @@
+http://{$OPENCODEX_DOMAIN} {
+  encode zstd gzip
+  reverse_proxy router:8080 {
+    flush_interval -1
+  }
+  header {
+    -Server
+    Strict-Transport-Security "max-age=31536000; includeSubDomains"
+  }
+}
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..4cad3a5
--- /dev/null
+++ b/README.md
@@ -0,0 +1,26 @@
+# Open-CDX
+
+Open-CDX runs its router service behind Caddy, with Nginx Proxy Manager
+providing the host-facing HTTPS entry point.
+
+## Deployment layout
+
+- **Compose:** `/srv/docker/open-cdx/docker-compose.yml`
+- **Static configuration/source:** `/srv/docker/open-cdx/Caddyfile`; there is no local build source or Dockerfile
+- **Non-secret environment:** `/srv/docker/open-cdx/.env` supplies `OPENCODEX_DOMAIN`; the listen address, public URL, database path, and secret-file paths are declared inline in Compose
+- **Secrets:** `/srv/docker/secrets/open-cdx/master_key` and `/srv/docker/secrets/open-cdx/admin_token`
+- **NVMe application state:** `/srv/appdata/open-cdx/router`, `/srv/appdata/open-cdx/caddy-data`, and `/srv/appdata/open-cdx/caddy-config`
+- **Bulk HDD data:** none
+- **Other mounts:** none
+
+Secrets are never committed to this repository. The master key and admin token
+are supplied only to the router service as Compose secrets at
+`/run/secrets/master_key` and `/run/secrets/admin_token`.
+
+## Dependencies and recovery
+
+- **Networks/dependencies:** Caddy depends on the healthy router; both services share the private project network,
+while only Caddy joins the external `npm_proxy` network at `192.168.98.24`; Nginx Proxy Manager forwards HTTP traffic
+to Caddy on port 80
+- **Back up:** `/srv/appdata/open-cdx/router`, `/srv/appdata/open-cdx/caddy-data`, `/srv/appdata/open-cdx/caddy-config`, and the separately protected master-key and admin-token files
+- **Re-creatable:** the router and Caddy containers from their images; no persistent cache or bulk-data path is declared
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..66fe78f
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,52 @@
+name: open-cdx
+
+services:
+  router:
+    image: "ghcr.io/dodelidoo-labs/open-cdx:latest"
+    restart: unless-stopped
+    expose:
+      - "8080"
+    environment:
+      OPENCODEX_LISTEN: ":8080"
+      OPENCODEX_PUBLIC_URL: "https://${OPENCODEX_DOMAIN:?set OPENCODEX_DOMAIN}"
+      OPENCODEX_DATABASE: "/var/lib/opencdx/router.db"
+      OPENCODEX_MASTER_KEY_FILE: "/run/secrets/master_key"
+      OPENCODEX_ADMIN_TOKEN_FILE: "/run/secrets/admin_token"
+    secrets:
+      - master_key
+      - admin_token
+    volumes:
+      - /srv/appdata/open-cdx/router:/var/lib/opencdx
+    networks:
+      - private
+
+  caddy:
+    image: caddy:2.10.2-alpine
+    restart: unless-stopped
+    depends_on:
+      router:
+        condition: service_healthy
+    environment:
+      OPENCODEX_DOMAIN: "${OPENCODEX_DOMAIN:?set OPENCODEX_DOMAIN}"
+    expose:
+      - "80"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - /srv/appdata/open-cdx/caddy-data:/data
+      - /srv/appdata/open-cdx/caddy-config:/config
+    networks:
+      private:
+      npm_proxy:
+        ipv4_address: 192.168.98.24
+
+secrets:
+  master_key:
+    file: /srv/docker/secrets/open-cdx/master_key
+  admin_token:
+    file: /srv/docker/secrets/open-cdx/admin_token
+
+networks:
+  private:
+    internal: false
+  npm_proxy:
+    external: true