Docker and Tunnel

Docker and Tunnel

The root Compose definition runs grimreach_server and grimreach_cloudflared on a private appnet. It publishes no host ports. The server image builds from the official Go image and runs as a nonroot process in a minimal image. Cloudflared uses the official cloudflare/cloudflared:latest image.

Operator setup

1. Create a remotely managed Cloudflare Tunnel for this host and configure the public hostname grimreach.mozrin.com with path /play to service http://grimreach_server:8081.
2. Put the tunnel token in a root .env as TUNNEL_TOKEN=.... .env is ignored by Git. Use a distinct tunnel identity and credential for a separate deployment host.
3. Start the services from the repository root:

docker compose config --quiet
docker compose up -d --build
docker compose ps
docker compose logs server cloudflared

/play carries WebSocket game sessions through the tunnel. The HTTP server also serves /health on port 8081 inside the private network. The legacy TCP listener on 7777 is not published by Compose; a local analytics process cannot reach that container through a host port in this topology.

The website root route is separate from the game route. The tunnel configuration observed during 0.1.0 testing pointed / at grimreach_website:8000, but that container was unavailable in this Compose stack. Issue #28 tracks the public website. The game /play route was independently verified with a public WebSocket welcome message.

Safety and troubleshooting

Keep the token outside Git and avoid printing it in logs or issues. No visitor access gate or account system exists yet, so anyone who knows the game URL can try to join. A healthy tunnel connection alone does not prove that its origin route works. Check the server container, the path rule, and a real WebSocket handshake when diagnosing connection failures. See Getting Started for client connection behavior.