Production deployment now matches the host setup that already runs
neuronetz.ai / neuro-landing: the gateway sits behind the jwilder
nginx-proxy + acme-companion already on the host, instead of bundling
its own Caddy sidecar.
- docker-compose.yml: drop the Caddy service entirely. The gateway joins
an external `proxy` Docker network (the same one neuronetz-web /
neuronetz-www use) and advertises itself with VIRTUAL_HOST /
VIRTUAL_PORT / LETSENCRYPT_HOST / LETSENCRYPT_EMAIL. nginx-proxy
routes TLS-terminated traffic to it on the shared network;
acme-companion handles Let's Encrypt issuance + renewal for
api.neuronetz.ai automatically. NO host ports are published in this
compose file anywhere — gateway, postgres, redis, ollama all stay
unreachable from the host. Pinned container_names
(neuronetz-gateway / -postgres / -redis / -ollama) for stable
identification by nginx-proxy and ops scripts.
- .env.example: add GATEWAY_VIRTUAL_HOST + LETSENCRYPT_EMAIL; flip the
default GATEWAY_TRUSTED_PROXIES to `127.0.0.1,nginx-proxy`.
- docs/DEPLOYMENT.md: the canonical path is now jwilder-proxy.
Reorganized prerequisites + steps around it; documented adding HSTS
and the other security headers via the nginx-proxy custom-config
mechanism (/etc/nginx/vhost.d/<host>). The Caddy sidecar lives on as
a documented alternative for hosts without jwilder-proxy
(ops/caddy/Caddyfile.example is kept).
The Ollama-never-exposed non-negotiable is unchanged.
One-command demo so the gateway can be exercised end-to-end without a GPU or a
real model download:
- demo/mock-ollama/ — tiny FastAPI service emulating Ollama (/api/tags,
/api/chat + /api/generate NDJSON streaming with realistic prompt_eval_count
and eval_count on the final frame, /api/embed, /api/show, /api/version).
Non-root multi-stage Dockerfile, never published (internal network only).
- docker-compose.demo.yml — postgres + redis + mock-ollama + gateway, with
PLAYGROUND_ENABLED=true and ./playground mounted read-only at /app/playground.
Mirrors the prod posture (mock-ollama not exposed).
- demo.sh — brings the stack up, waits on /healthz, creates a demo tenant with
allow_all_models and a fresh API key via the bootstrap CLI inside the
container, then prints the key, the playground URL, and five ready-to-paste
curl commands (SSE chat, NDJSON chat, /v1/models, a 401, a 403 /api/pull).
./demo.sh --down tears everything back down with volumes.
- playground/index.html — single-file dark-themed UI served same-origin by
the gateway at /playground (CORS-free). Per-endpoint About card with method/
auth/streaming badges, a real description, sample request body, sample
response, and a footer note. Live SSE/NDJSON rendering of the response.
A live, copyable curl box that mirrors exactly what Run sends. Run + Refresh
are visibly gated until an API key is in the field; the Base URL is
force-pinned to location.origin three times to defeat browser autofill.
- docs/ — API.md (full endpoint reference with curl, streaming formats, error
model, SPEC §6.5 response headers), ARCHITECTURE.md (incl. §4.6 discovery
+ the request lifecycle), DEPLOYMENT.md (Ollama-never-exposed rule,
pointing at a real Ollama backend, env reference), THREAT_MODEL.md
(SPEC §3 table + the allow_all_models opt-in notes), OPERATIONS.md
(key/budget/model/usage runbook + fail-closed table), PLAYGROUND.md.
mkdocs.yml (Material theme) wires them together.
