# Open-CDX

Open-CDX runs its router service behind Caddy, with Nginx Proxy Manager
providing the host-facing HTTPS entry point.

## Deployment layout

- **Compose:** `/srv/docker/open-cdx/docker-compose.yml`
- **Static configuration/source:** `/srv/docker/open-cdx/Caddyfile`; there is no local build source or Dockerfile
- **Non-secret environment:** `/srv/docker/open-cdx/.env` supplies `OPENCODEX_DOMAIN`; the listen address, public URL, database path, and secret-file paths are declared inline in Compose
- **Secrets:** `/srv/docker/secrets/open-cdx/master_key` and `/srv/docker/secrets/open-cdx/admin_token`
- **NVMe application state:** `/srv/appdata/open-cdx/router`, `/srv/appdata/open-cdx/caddy-data`, and `/srv/appdata/open-cdx/caddy-config`
- **Bulk HDD data:** none
- **Other mounts:** none

Secrets are never committed to this repository. The master key and admin token
are supplied only to the router service as Compose secrets at
`/run/secrets/master_key` and `/run/secrets/admin_token`.

## Dependencies and recovery

- **Networks/dependencies:** Caddy depends on the healthy router; both services share the private project network,
while only Caddy joins the external `npm_proxy` network at `192.168.98.24`; Nginx Proxy Manager forwards HTTP traffic
to Caddy on port 80
- **Back up:** `/srv/appdata/open-cdx/router`, `/srv/appdata/open-cdx/caddy-data`, `/srv/appdata/open-cdx/caddy-config`, and the separately protected master-key and admin-token files
- **Re-creatable:** the router and Caddy containers from their images; no persistent cache or bulk-data path is declared