Compose: /srv/docker/open-cdx/docker-compose.yml
Static configuration/source: /srv/docker/open-cdx/Caddyfile; there is no local build source or Dockerfile
Non-secret environment: /srv/docker/open-cdx/.env supplies OPENCODEX_DOMAIN; the listen address, public URL, database path, and secret-file paths are declared inline in Compose
Secrets: /srv/docker/secrets/open-cdx/master_key and /srv/docker/secrets/open-cdx/admin_token
NVMe application state: /srv/appdata/open-cdx/router, /srv/appdata/open-cdx/caddy-data, and /srv/appdata/open-cdx/caddy-config
Bulk HDD data: none
Other mounts: none

Secrets are never committed to this repository. The master key and admin token are supplied only to the router service as Compose secrets at /run/secrets/master_key and /run/secrets/admin_token.

Dependencies and recovery

Networks/dependencies: Caddy depends on the healthy router; both services share the private project network, while only Caddy joins the external npm_proxy network at 192.168.98.24; Nginx Proxy Manager forwards HTTP traffic to Caddy on port 80
Back up: /srv/appdata/open-cdx/router, /srv/appdata/open-cdx/caddy-data, /srv/appdata/open-cdx/caddy-config, and the separately protected master-key and admin-token files
Re-creatable: the router and Caddy containers from their images; no persistent cache or bulk-data path is declared