From c8b2cc815266eaf8b71cc4591c92493cfaa4c4aa Mon Sep 17 00:00:00 2001
From: lekss361 <claudestars@proton.me>
Date: Sat, 25 Apr 2026 20:59:26 +0300
Subject: [PATCH] fix

---
 Caddyfile               | 41 ++++++++++++++++++++++++++++++++---------
 docker-compose.prod.yml |  4 ++++
 2 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/Caddyfile b/Caddyfile
index fcb73917..dc1d6d3a 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -1,20 +1,43 @@
-# Replace gendesign.example.ru with your actual domain.
-# Caddy will auto-issue Let's Encrypt certificate.
+# Caddy config.
+#
+# Two site blocks:
+# 1. :80 — handles all HTTP traffic by IP (no domain yet) for development access.
+#    Returns plain HTTP, no TLS. Will be removed once a domain is bought.
+# 2. gendesign.example.ru — production block with auto-TLS via Let's Encrypt.
+#    Activates only after DNS A-record is set on this domain.
+#
+# Replace gendesign.example.ru with your actual domain when bought.
 
-gendesign.example.ru {
+:80 {
     encode zstd gzip
 
-    # Frontend (Next.js)
-    handle {
-        reverse_proxy frontend:3000
-    }
-
     # Backend API
     handle_path /api/* {
         reverse_proxy backend:8000
     }
 
-    handle_path /health {
+    handle /health {
         reverse_proxy backend:8000
     }
+
+    # Frontend (Next.js) — catches everything else
+    handle {
+        reverse_proxy frontend:3000
+    }
+}
+
+gendesign.example.ru {
+    encode zstd gzip
+
+    handle_path /api/* {
+        reverse_proxy backend:8000
+    }
+
+    handle /health {
+        reverse_proxy backend:8000
+    }
+
+    handle {
+        reverse_proxy frontend:3000
+    }
 }
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 5ce0a7c0..bd1110ec 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -18,6 +18,10 @@ services:
       POSTGRES_DB: ${POSTGRES_DB}
       POSTGRES_USER: ${POSTGRES_USER}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    # Bind to 127.0.0.1 only — accessible from host (for SSH tunnel) but not from public internet.
+    # UFW additionally blocks 5432 from outside.
+    ports:
+      - "127.0.0.1:5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck: