1# Public edge for the forge. Fly terminates TLS for HTTP and passes raw TCP2# for git over ssh; tailcat carries both over WireGuard to the forge3# container, which accepts only this edge's client key. Caddy in front of the4# HTTP side serves the pages mirror while the forge is down. Stateless.5FROM golang:1.27.2 AS tailcat6RUN CGO_ENABLED=0 GOBIN=/out go install github.com/tailscale/tailcat/cmd/tailcat@v0.7.078FROM alpine:39RUN apk add --no-cache ca-certificates caddy10COPY --from=tailcat /out/tailcat /usr/local/bin/tailcat11COPY Caddyfile /etc/caddy/Caddyfile12COPY start.sh /start.sh13RUN chmod +x /start.sh14EXPOSE 2222 808015ENTRYPOINT ["/start.sh"]