snapshot of https://github.com/makeplane/plane.git @ d868349a55de79979eb8b98701bf1702c67ad634 (2026-09-15)

apps/proxy/.prettierignore

@@ -0,0 +1,10 @@
+.next/
+.react-router/
+.turbo/
+.vite/
+build/
+dist/
+node_modules/
+out/
+pnpm-lock.yaml
+storybook-static/

apps/proxy/Caddyfile.aio.ce

@@ -0,0 +1,46 @@
+(plane_proxy) {
+	request_body {
+		max_size {$FILE_SIZE_LIMIT}
+	}
+
+    handle /spaces/* {
+        reverse_proxy localhost:3002
+    }
+	
+    handle /live/* {
+        reverse_proxy localhost:3005
+    }
+	handle /api/* {
+        reverse_proxy localhost:3004
+    }
+
+	handle /auth/* {
+        reverse_proxy localhost:3004
+    }
+
+	handle_path /god-mode* {
+        root * /app/admin
+        try_files {path} {path}/ /index.html
+        file_server
+    }
+    handle_path /* {
+        root * /app/web
+        try_files {path} {path}/ /index.html
+        file_server
+    }
+}
+
+{
+	{$CERT_EMAIL}
+	acme_ca {$CERT_ACME_CA:https://acme-v02.api.letsencrypt.org/directory} 
+	{$CERT_ACME_DNS}
+	servers {
+		max_header_size 25MB
+		client_ip_headers X-Forwarded-For X-Real-IP
+		trusted_proxies static {$TRUSTED_PROXIES:0.0.0.0/0}
+	}
+}
+
+{$SITE_ADDRESS} {
+	import plane_proxy
+}

apps/proxy/Caddyfile.ce

@@ -0,0 +1,39 @@
+(plane_proxy) {
+	request_body {
+		max_size {$FILE_SIZE_LIMIT}
+	}
+
+  redir /spaces /spaces/ permanent
+	reverse_proxy /spaces/* space:3000
+
+  redir /god-mode /god-mode/ permanent
+	reverse_proxy /god-mode/* admin:3000
+	
+	reverse_proxy /live/* live:3000
+
+	reverse_proxy /api/* api:8000
+
+	reverse_proxy /auth/* api:8000
+
+	reverse_proxy /static/* api:8000
+
+	reverse_proxy /{$BUCKET_NAME}/* plane-minio:9000
+	reverse_proxy /{$BUCKET_NAME} plane-minio:9000
+
+	reverse_proxy /* web:3000
+}
+
+{
+	{$CERT_EMAIL}
+	acme_ca {$CERT_ACME_CA:https://acme-v02.api.letsencrypt.org/directory} 
+	{$CERT_ACME_DNS}
+	servers {
+		max_header_size 25MB
+		client_ip_headers X-Forwarded-For X-Real-IP
+		trusted_proxies static {$TRUSTED_PROXIES:0.0.0.0/0}
+	}
+}
+
+{$SITE_ADDRESS} {
+	import plane_proxy
+}

apps/proxy/Dockerfile.ce

@@ -0,0 +1,45 @@
+FROM caddy:2.11.4-builder-alpine AS caddy-builder
+
+# grpc and otel move together: grpc >= v1.83.0 requires otel v1.44.0, and xcaddy
+# resolves these --with pins in one `go get`, so a stale otel pin makes go walk
+# grpc backwards until it finds one that fits (silently, with a zero exit) --
+# it lands on the v1.83.0-dev pre-release and the build still succeeds. Bump the
+# otel pair in lockstep with grpc, and confirm with `go version -m` afterwards.
+RUN XCADDY_SKIP_CLEANUP=1 xcaddy build \
+        --with github.com/caddy-dns/cloudflare@v0.2.1 \
+        --with github.com/caddy-dns/digitalocean@04bde2867106aa1b44c2f9da41a285fa02e629c5 \
+        --with github.com/mholt/caddy-l4@6faae83b167fda94e62b686be5cbeb9b3f8fe002 \
+        --with github.com/go-jose/go-jose/v3@v3.0.5 \
+        --with github.com/go-jose/go-jose/v4@v4.1.4 \
+        --with google.golang.org/grpc@v1.83.1 \
+        --with go.opentelemetry.io/otel@v1.44.0 \
+        --with go.opentelemetry.io/otel/sdk@v1.44.0
+
+# Caddy's own go.mod pins x/crypto, x/net and x/text at versions with open CVEs;
+# xcaddy preserved its build dir above, so upgrade them there and rebuild.
+# x/crypto v0.55.0 requires x/net v0.57.0 and x/text v0.41.0, hence those floors.
+RUN cd "$(find /tmp -maxdepth 1 -name 'buildenv_*' -type d | head -1)" && \
+    go get golang.org/x/crypto@v0.55.0 && \
+    go get golang.org/x/net@v0.57.0 && \
+    go get golang.org/x/text@v0.41.0 && \
+    go mod tidy && \
+    go build -o /usr/bin/caddy -ldflags "-w -s" -trimpath -tags nobadger,nomysql,nopgx .
+
+# xcaddy resolves every --with pin in a single `go get`, which walks a module
+# backwards to an older release rather than failing when the pins conflict.
+# Assert the binary really carries the pinned grpc, so a silent downgrade fails
+# the build instead of shipping a proxy that only looks patched.
+RUN go version -m /usr/bin/caddy | grep -qE 'google\.golang\.org/grpc[[:space:]]v1\.83\.1[[:space:]]' \
+    || { echo "caddy was not built against the pinned grpc -- check the --with pins" >&2; exit 1; }
+
+FROM caddy:2.11.4-alpine
+
+# OS security updates. --available forces reinstall from the current repos;
+# bump APK_SECURITY_PATCH to bust buildx's cached layer (keyed on this command
+# string), otherwise a rebuild silently re-ships the old packages.
+ARG APK_SECURITY_PATCH=2026-09-07
+RUN echo "apk-security-patch ${APK_SECURITY_PATCH}" && apk update && apk upgrade --no-cache --available && apk add --no-cache nss-tools bash curl
+
+COPY --from=caddy-builder /usr/bin/caddy /usr/bin/caddy
+
+COPY Caddyfile.ce /etc/caddy/Caddyfile