Deploying with Kamal

[mike-weiner]

I'm curious if folks have deployed Campfire via Kamal. I'm wondering how the TLS works since Kamal handles TLS but the Campfire installer also tries to handle TLS.

[monorkin]

I use this deploy.yaml file with thruster for send-file and Cloudflare for TLS and DNS.
The trick is to tell thruster to disable SSL on its end. You can read about its configuration ENV vars in its repo.

service: campfire

# Change this to your repo, for GHCR it should be <username>/<repository>
image: username/campfire

servers:
  web:
    - chat.example.com

# Enable SSL auto certification via Let's Encrypt (and allow for multiple apps on one server).
# If using something like Cloudflare, it is recommended to set encryption mode 
# in Cloudflare's SSL/TLS setting to "Full" to enable end-to-end encryption. 
proxy:
  ssl: true
  host: chat.example.com
  healthcheck:
    path: /up
    interval: 6
    timeout: 10

# Credentials for your image host. This assumes you have the `gh` CLI installed and configured
registry:
  server: ghcr.io
  username: <%= ENV["GITHUB_USERNAME"] || `gh auth status`.scan(/github.com account ([^\s]+)\s/).flatten.first %>
  password:
    - KAMAL_REGISTRY_PASSWORD

# Configure builder setup.
builder:
  arch: amd64
  args:
    APP_VERSION: "1.0.0."
    GIT_REVISION: <%= `git rev-parse HEAD` %>

# Inject ENV variables into containers (secrets come from .kamal/secrets).
env:
  clear:
    DISABLE_SSL: "YES" # The proxy will terminate SSL, no need for Thruster to do the same
    SSL_DOMAIN: "chat.example.com"
  secret:
    - SECRET_KEY_BASE
    - VAPID_PRIVATE_KEY
    - VAPID_PUBLIC_KEY

ssh:
  user: ubuntu

volumes:
  - "/home/ubuntu/campfire/storage/:/rails/storage"

(You have to configure the secrets on your own, just follow the Kamal guide for your preferred storage method)

[mike-weiner]

Perfect. Thank you!