43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
services:
|
|
app:
|
|
image: mauriceboe/trek:latest
|
|
container_name: trek
|
|
read_only: true
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- CHOWN
|
|
- SETUID
|
|
- SETGID
|
|
tmpfs:
|
|
- /tmp:noexec,nosuid,size=64m
|
|
ports:
|
|
- "4000:3000"
|
|
environment:
|
|
- NODE_ENV=production
|
|
- PORT=3000
|
|
- ENCRYPTION_KEY=${ENCRYPTION_KEY:-} # generate with: openssl rand -hex 32
|
|
- TZ=${TZ:-UTC}
|
|
- LOG_LEVEL=${LOG_LEVEL:-info}
|
|
- ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-}
|
|
- APP_URL=${APP_URL:-} # required for OIDC + email links
|
|
- FORCE_HTTPS=true # behind a TLS-terminating proxy
|
|
# - TRUST_PROXY=1
|
|
# - OIDC_ISSUER=https://auth.example.com
|
|
# - OIDC_CLIENT_ID=trek
|
|
# - OIDC_CLIENT_SECRET=supersecret
|
|
# - OIDC_DISPLAY_NAME=SSO
|
|
# - OIDC_ADMIN_CLAIM=groups
|
|
# - OIDC_ADMIN_VALUE=app-trek-admins
|
|
volumes:
|
|
- ./data:/app/data
|
|
- ./uploads:/app/uploads
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 15s |