Make Caddy host port configurable

.env

@@ -10,6 +10,7 @@ PROXY_PORT=
 USE_PROXY_AUTH=0
 PROXY_AUTH_USER=
 PROXY_AUTH_PASS=
+ERAMBA_HOST_PORT=8443
 PUBLIC_ADDRESS=https://localhost:8443
 ERAMBA_MCP_IMAGE_TAG=latest
 OAUTH2_INTROSPECTION_CLIENT_ID=eramba-mcp-introspect

README.md

@@ -4,4 +4,6 @@ The bundled files in `apache/ssl/` are a branded local development certificate i
 
 Eramba and its MCP endpoint share the `PUBLIC_ADDRESS` origin. With the default configuration the application is available at `https://localhost:8443` and MCP at `https://localhost:8443/mcp`; issuer, resource, metadata, and OpenAPI URLs are derived automatically. Do not add separate public MCP URL variables.
 
+`ERAMBA_HOST_PORT` controls the HTTPS port published by Caddy on the Docker host and defaults to `8443`. When changing it, keep `PUBLIC_ADDRESS` aligned with the externally visible origin; the values may intentionally differ when a reverse proxy or load balancer maps a different public port. This changes only the Docker host mapping: Caddy and Eramba continue to use HTTPS port `443` internally, so `apache/ports.conf` and the Apache virtual host do not need to change.
+
 Before starting a real deployment, replace `OAUTH2_INTROSPECTION_CLIENT_SECRET` in `.env` with a unique random secret. `ERAMBA_MCP_IMAGE_TAG` defaults to the latest MCP image and can be pinned when required.

docker-compose.simple-install.yml

@@ -167,7 +167,7 @@ services:
     container_name: public_proxy
     image: caddy:2.8-alpine
     ports:
-      - 8443:443
+      - "${ERAMBA_HOST_PORT:-8443}:443"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - ./apache/ssl/mycert.crt:/certs/mycert.crt:ro

tests/mcp-simple-install.bats

@@ -27,6 +27,17 @@ setup() {
   [ "$(jq -r '.services.public_proxy.ports[0] | "\(.published):\(.target)"' <<<"$COMPOSE_CONFIG")" = "8443:443" ]
 }
 
+@test "Caddy host port can be overridden without changing its internal port" {
+  run env -i PATH="$PATH" HOME="$HOME" ERAMBA_HOST_PORT=9443 docker compose \
+    --project-directory "$REPOSITORY_ROOT" \
+    --env-file "$REPOSITORY_ROOT/.env" \
+    -f "$REPOSITORY_ROOT/docker-compose.simple-install.yml" \
+    config --format json
+
+  [ "$status" -eq 0 ]
+  [ "$(jq -r '.services.public_proxy.ports[0] | "\(.published):\(.target)"' <<<"$output")" = "9443:443" ]
+}
+
 @test "MCP derives public metadata from PUBLIC_ADDRESS and introspects internally" {
   [ "$(jq -r '.services.mcp_server.environment.PUBLIC_ADDRESS' <<<"$COMPOSE_CONFIG")" = "https://localhost:8443" ]
   [ "$(jq -r '.services.mcp_server.environment.ERAMBA_OAUTH_INTROSPECTION_URL' <<<"$COMPOSE_CONFIG")" = "https://eramba:443/oauth2/introspect" ]