Skip to content

0007 — Single-VPS Docker Compose + Caddy edge

Status: reconstructed — needs confirmation

Context

Early-stage product, small team, modest traffic. Needs TLS for six hostnames and strict isolation between public and data services.

Decision

Everything runs on one VPS (200.141.2.55, Ubuntu 24.04) under Docker Compose (deploy/docker-compose.yml). Caddy 2 is the only container with published ports (80/443); it terminates TLS with automatic Let's Encrypt certificates and routes by hostname (deploy/Caddyfile). Two named networks separate concerns: aim_edge (Caddy ↔ apps) and aim_data (apps ↔ postgres/redis/minio, never published). The monitoring stack joins aim_edge only for Grafana routing and Prometheus scraping.

Consequences

  • Zero-config TLS; adding a vhost is a Caddyfile block + DNS record.
  • Single point of failure and a 1-vCPU ceiling; images are therefore built in CI, never on the server (see ADR 0008).
  • Compose files in git are the source of truth — the deploy workflows overwrite the server copies on every run.