blob: 01825e47edb214624526eff2cc8ca4e168f620f0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
name: bokf
services:
bokfd:
image: ${BOKF_IMAGE:-ghcr.io/yourname/bokf}:${BOKF_TAG:-latest}
build:
context: .
restart: unless-stopped
ports:
- "8788:8788"
volumes:
- ./var/db:/var/lib/bokfd
- ./var/run:/run/bokfd
environment:
BOKFD_DB: /var/lib/bokfd/bokfd.db
BOKFD_SOCKET: /run/bokfd/bokfd.sock
BOKFD_BACKUP_DIR: /var/lib/bokfd/backup
BOKFD_EXPORT_DIR: /var/lib/bokfd/export
BOKFD_LOG_LEVEL: info
BOKFD_SECRET_KEY: ${BOKFD_SECRET_KEY:-}
BOKFD_TLS: 0.0.0.0:8788
BOKFD_TLS_CERT: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.crt
BOKFD_TLS_KEY: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.key
# Web frontend: login gate + browser terminal on http://127.0.0.1:8790.
# The host's TLS proxy serves it as https://bokf.makandra.eu/web (see
# deploy/Caddyfile and docs/DEPLOY.md). Talks to bokfd over the socket
# only; read-only, no capabilities.
web:
image: ${BOKF_WEB_IMAGE:-bokf-web}:${BOKF_TAG:-latest}
restart: unless-stopped
depends_on:
- bokfd
ports:
- "127.0.0.1:8790:8790"
volumes:
- ./var/run:/run/bokfd
environment:
BOKF_WEB_MAX_SESSIONS: ${BOKF_WEB_MAX_SESSIONS:-20}
read_only: true
tmpfs:
- /tmp:size=256m,mode=1777
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
pids_limit: 512
mem_limit: 2g
certs:
image: goacme/lego:latest
restart: unless-stopped
entrypoint: ["/bin/sh", "-c"]
command:
- |
while :; do
if [ -n "$INWX_USERNAME" ] && [ -n "$INWX_PASSWORD" ]; then
/lego run --path=/certs --email="$LEGO_EMAIL" --dns=inwx \
--domains="$LEGO_DOMAIN" --accept-tos --renew-days=30 || true
chown -R 10001:10001 /certs || true
else
echo "certs: set INWX_USERNAME and INWX_PASSWORD in .env"
fi
sleep 12h
done
environment:
LEGO_EMAIL: ${LEGO_EMAIL:-anders@makandra.eu}
LEGO_DOMAIN: ${LEGO_DOMAIN:-bokf.makandra.eu}
INWX_USERNAME: ${INWX_USERNAME:-}
INWX_PASSWORD: ${INWX_PASSWORD:-}
volumes:
- ./var/db/certs:/certs
|
