Running on non-standard ports
By default, Canasta uses ports 80 (HTTP) and 443 (HTTPS). On Docker Compose, the HAProxy edge serves every instance on a host and routes each request by its hostname, so several instances with their own hostnames can share those ports. To use different ports, for example for a second instance reached by localhost or an IP address, the approach depends on whether you are creating a new instance or changing an existing one.
TLS certificates and non-standard ports
When Canasta is configured with a real domain name, the HAProxy edge obtains a TLS certificate from Let's Encrypt automatically. With the default TLS_MODE=acme, this uses the ACME HTTP-01 challenge, which always connects to port 80 on your server. An instance whose HTTP_PORT is not 80 therefore gets certificates only if port 80 on the host reaches the edge, that is, if another instance on the host uses port 80.
Otherwise, choose another TLS_MODE for the instance: acme-dns (Let's Encrypt by DNS validation, which does not use port 80), internal (the edge's own CA, for local development and testing), or custom (a certificate you supply). See Certificates.
New instance
Pass an env file with port settings to canasta create. Create a file called custom.env:
HTTP_PORT=8080
HTTPS_PORT=8443
canasta create -i staging -w testwiki -n localhost -e custom.env
Pass --domain-name (-n) as a bare hostname — do not include the port. The port comes from the env file, and the CLI combines them for you. After the instance starts, access the wiki at https://localhost:8443.
Existing instance
Use canasta config set. Multiple settings can be changed in a single command. The HTTPS_PORT side effect automatically updates config/wikis.yaml URLs, MW_SITE_SERVER, and MW_SITE_FQDN to match:
canasta config set HTTP_PORT=8080 HTTPS_PORT=8443
The instance restarts, and the HAProxy edge then serves it on the new ports and redirects its HTTP port to its HTTPS port.
To revert to the default ports (80/443), remove the overrides:
canasta config unset HTTP_PORT HTTPS_PORT
Multiple instances on localhost
The HAProxy edge cannot tell instances reached by localhost apart by name, so only one instance per port can use localhost or an IP address. Give each further instance its own ports.
# Default ports (80/443)
canasta create -i production -w mainwiki -n localhost
# Custom ports
canasta create -i staging -w testwiki -n localhost -e custom.env
Access them at https://localhost and https://localhost:8443.
The HAProxy edge serves all of a host's instances and routes each request by its hostname. To put a reverse proxy of your own (such as Caddy or nginx) in front of them, have it terminate TLS and forward plain HTTP to each instance's HTTP_PORT. The reverse proxy holds ports 80/443 and obtains the certificates; each Canasta instance serves plain HTTP on its own internal port and lets the proxy terminate TLS.
Disable the instance's own ACME and set its internal HTTP port in custom.env:
TLS_MODE=off
HTTP_PORT=8080
canasta create -i staging -w testwiki -n example.com -e custom.env
Also set TRUSTED_PROXIES to the address range your proxy connects from, so the HAProxy edge takes each client's address from the proxy's X-Forwarded-For header and applies per-client rate limits; without it the edge applies none. See Ports and plain HTTP.
Then point MediaWiki at the public HTTPS address the proxy serves. This step is required: canasta create derives the server URL from the instance's own internal port and scheme, not from the proxy's public URL.
canasta config set MW_SITE_SERVER=https://example.com --id staging
Finally, configure the reverse proxy to forward traffic for example.com to the instance's internal HTTP port (8080 in the example above).
Kubernetes
On Kubernetes, multiple instances on the same cluster typically share the standard ports (80/443) and are differentiated by hostname via the cluster's ingress controller, rather than by port. See Ingress and TLS.
