jdsjkdjk

docker-compose.yml

@@ -15,10 +15,11 @@ services:
   frontend:
     image: git.aranroig.com/syndria98/mathew-frontend:latest
     environment:
-      # Where the browser finds the Lean editor server below (the wiki's
-      # /lean frames it). An https:// site needs an https:// address here,
-      # or the browser refuses the frame — see lean/README.md.
-      NUXT_PUBLIC_LEAN_URL: ${NUXT_PUBLIC_LEAN_URL:-http://mathew.aranroig.com:8080}
+      # Where the browser finds the Lean editor server: the site's own https
+      # origin, proxied to the lean service by nginx (/api/lean). An https://
+      # site needs an https:// address here — the websocket's wss:// is derived
+      # from it, and an http:// server would be refused as mixed content.
+      NUXT_PUBLIC_LEAN_URL: ${NUXT_PUBLIC_LEAN_URL:-https://mathew.aranroig.com/api/lean}
     restart: always
 
   # The Lean editor (lean4web) — its own server, since it runs a real Lean
@@ -33,8 +34,11 @@ services:
       # args:
       #   BAKE_MATHLIB: "false"
     image: git.aranroig.com/syndria98/mathew-lean:latest
+    # Reachable only from this host (dev's frontend) and nginx; the public way
+    # in is https://mathew.aranroig.com/api/lean. Publishing the port would
+    # hand anyone on the internet a Lean shell — see lean/README.md.
     ports:
-      - "8080:8080"
+      - "127.0.0.1:8080:8080"
     restart: always
     # Only with BAKE_MATHLIB: "false" above:
     # volumes: