DEV Community

Cover image for LioranDB TypeScript Series #11: Deploy LioranDB with Docker Compose, Caddy and TLS
Swaraj Puppalwar
Swaraj Puppalwar

Posted on

LioranDB TypeScript Series #11: Deploy LioranDB with Docker Compose, Caddy and TLS

#liorandb #typescript #database #rust

LioranDB TypeScript Series #11: Deploy LioranDB with Docker Compose, Caddy and TLS

LioranDB TypeScript Series: Build with a developer-first document database powered by Rust and designed for TypeScript.

Running LioranDB locally is easy.

Exposing a database server to the internet deserves considerably more care.

Let's build a cleaner managed deployment.

Architecture

Instead of publishing every LioranDB port:

Internet
   ↓
HTTPS / TLS
   ↓
Caddy
   ↓
Docker network
   ↓
LioranDB
Enter fullscreen mode Exit fullscreen mode

Only the reverse proxy should be publicly reachable.

Example Caddy configuration 

acme.db.example.com {
  reverse_proxy liorandb:27018
}

acme.grpc.example.com {
  reverse_proxy h2c://liorandb:27019
}
Enter fullscreen mode Exit fullscreen mode

Caddy handles the public TLS edge while LioranDB remains inside the Docker network.

Docker Compose 

services:
  liorandb:
    image: liorandb/liorandb:pre-alpha
    container_name: liorandb-acme
    restart: unless-stopped

    cpus: 2.0
    mem_limit: 3.5g

    environment:
      LIORANDB_TLS_MODE: insecure
      LIORANDB_GRPC_BIND_ADDR: 0.0.0.0:27019
      LIORANDB_METRICS_ADDR: 0.0.0.0:27201

      LIORANDB_ADVERTISED_HTTP_ADDR: acme.db.example.com:443
      LIORANDB_ADVERTISED_GRPC_ADDR: acme.grpc.example.com:443

      LIORANDB_BOOTSTRAP_PASSWORD_FILE: /run/liorandb/bootstrap-password.txt

    expose:
      - "27018"
      - "27019"
      - "27201"

    volumes:
      - liorandb-data:/var/lib/liorandb/data
      - ./bootstrap-password.txt:/run/liorandb/bootstrap-password.txt:ro

    networks:
      - public-edge
      - metrics-private

  caddy:
    image: caddy:2
    restart: unless-stopped

    ports:
      - "80:80"
      - "443:443"

    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro

    networks:
      - public-edge

volumes:
  liorandb-data:

networks:
  public-edge:

  metrics-private:
    internal: true
Enter fullscreen mode Exit fullscreen mode

Notice what's missing

There is no:

ports:
  - "27018:27018"
  - "27019:27019"
  - "27201:27201"
Enter fullscreen mode Exit fullscreen mode

on the LioranDB service.

That's deliberate.

expose makes the ports available to services on the Docker network without publishing them directly on the host.

Firewall

For a typical Ubuntu deployment, the public firewall should only need the services you intentionally expose, such as:

22   SSH
80   HTTP
443  HTTPS
Enter fullscreen mode Exit fullscreen mode

Don't casually expose:

27018
27019
27201
Enter fullscreen mode Exit fullscreen mode

to the public internet.

Bootstrap password file

Generate a strong secret:

openssl rand -base64 32
Enter fullscreen mode Exit fullscreen mode

Store it in:

bootstrap-password.txt
Enter fullscreen mode Exit fullscreen mode

Then restrict access:

chmod 600 bootstrap-password.txt
Enter fullscreen mode Exit fullscreen mode

The container receives it as a read-only mounted file.

Deployment flow

Validate your Compose configuration:

docker compose config
Enter fullscreen mode Exit fullscreen mode

Start everything:

docker compose up -d
Enter fullscreen mode Exit fullscreen mode

Inspect:

docker compose ps
Enter fullscreen mode Exit fullscreen mode

Then verify health/readiness and advertised endpoints before connecting application traffic.

Application connection

Your application can then connect through the public TLS endpoint:

liorandb://admin:<encoded-password>@acme.db.example.com:443/default
Enter fullscreen mode Exit fullscreen mode

Remember to URL-encode the password.

The important boundary

The database is not your public web server.

Treat the reverse proxy as the edge and keep the database itself on the private network.

That one architectural decision removes an impressive collection of future headaches.

Resources

Managed Deployment Guide:
https://docs.liorandb.com/docs/deployment/managed

Documentation: https://docs.liorandb.com
Website: https://liorandb.com

Previous: Part 10 → Official CLI
Next: Part 12 → Production Patterns, Diagnostics & What's Next
Enter fullscreen mode Exit fullscreen mode

Top comments (0)