From 640cc10ebbb1c3c3c0f86459c2ea6db6756df798 Mon Sep 17 00:00:00 2001
From: shrkz1 <shrkz1@gmail.com>
Date: Wed, 19 Aug 2026 11:54:58 +0200
Subject: [PATCH] Make Caddy host port configurable

---
 .env                              |  1 +
 README.md                         |  2 ++
 docker-compose.simple-install.yml |  2 +-
 tests/mcp-simple-install.bats     | 11 +++++++++++
 4 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.env b/.env
index d7e15a9..98b2ecb 100644
--- a/.env
+++ b/.env
@@ -10,6 +10,7 @@ PROXY_PORT=
 USE_PROXY_AUTH=0
 PROXY_AUTH_USER=
 PROXY_AUTH_PASS=
+ERAMBA_HOST_PORT=8443
 PUBLIC_ADDRESS=https://localhost:8443
 ERAMBA_MCP_IMAGE_TAG=latest
 OAUTH2_INTROSPECTION_CLIENT_ID=eramba-mcp-introspect
diff --git a/README.md b/README.md
index eadf4a8..1fda060 100644
--- a/README.md
+++ b/README.md
@@ -4,4 +4,6 @@ The bundled files in `apache/ssl/` are a branded local development certificate i
 
 Eramba and its MCP endpoint share the `PUBLIC_ADDRESS` origin. With the default configuration the application is available at `https://localhost:8443` and MCP at `https://localhost:8443/mcp`; issuer, resource, metadata, and OpenAPI URLs are derived automatically. Do not add separate public MCP URL variables.
 
+`ERAMBA_HOST_PORT` controls the HTTPS port published by Caddy on the Docker host and defaults to `8443`. When changing it, keep `PUBLIC_ADDRESS` aligned with the externally visible origin; the values may intentionally differ when a reverse proxy or load balancer maps a different public port. This changes only the Docker host mapping: Caddy and Eramba continue to use HTTPS port `443` internally, so `apache/ports.conf` and the Apache virtual host do not need to change.
+
 Before starting a real deployment, replace `OAUTH2_INTROSPECTION_CLIENT_SECRET` in `.env` with a unique random secret. `ERAMBA_MCP_IMAGE_TAG` defaults to the latest MCP image and can be pinned when required.
diff --git a/docker-compose.simple-install.yml b/docker-compose.simple-install.yml
index 00db531..ec76d95 100644
--- a/docker-compose.simple-install.yml
+++ b/docker-compose.simple-install.yml
@@ -167,7 +167,7 @@ services:
     container_name: public_proxy
     image: caddy:2.8-alpine
     ports:
-      - 8443:443
+      - "${ERAMBA_HOST_PORT:-8443}:443"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - ./apache/ssl/mycert.crt:/certs/mycert.crt:ro
diff --git a/tests/mcp-simple-install.bats b/tests/mcp-simple-install.bats
index cc7d63e..7689c37 100644
--- a/tests/mcp-simple-install.bats
+++ b/tests/mcp-simple-install.bats
@@ -27,6 +27,17 @@ setup() {
   [ "$(jq -r '.services.public_proxy.ports[0] | "\(.published):\(.target)"' <<<"$COMPOSE_CONFIG")" = "8443:443" ]
 }
 
+@test "Caddy host port can be overridden without changing its internal port" {
+  run env -i PATH="$PATH" HOME="$HOME" ERAMBA_HOST_PORT=9443 docker compose \
+    --project-directory "$REPOSITORY_ROOT" \
+    --env-file "$REPOSITORY_ROOT/.env" \
+    -f "$REPOSITORY_ROOT/docker-compose.simple-install.yml" \
+    config --format json
+
+  [ "$status" -eq 0 ]
+  [ "$(jq -r '.services.public_proxy.ports[0] | "\(.published):\(.target)"' <<<"$output")" = "9443:443" ]
+}
+
 @test "MCP derives public metadata from PUBLIC_ADDRESS and introspects internally" {
   [ "$(jq -r '.services.mcp_server.environment.PUBLIC_ADDRESS' <<<"$COMPOSE_CONFIG")" = "https://localhost:8443" ]
   [ "$(jq -r '.services.mcp_server.environment.ERAMBA_OAUTH_INTROSPECTION_URL' <<<"$COMPOSE_CONFIG")" = "https://eramba:443/oauth2/introspect" ]