61 lines
2.4 KiB
YAML
61 lines
2.4 KiB
YAML
# Church key register
|
|
#
|
|
# One container, one SQLite file. Access comes from Tailscale, not from
|
|
# opening a port to the network.
|
|
|
|
services:
|
|
keyreg:
|
|
# Build locally, or point IMAGE at a registry copy and drop `build:`
|
|
# entirely — the image is self-contained and needs no source tree.
|
|
# IMAGE=ghcr.io/you/keyreg:1.0 docker compose up -d
|
|
build: .
|
|
image: ${IMAGE:-keyreg:local}
|
|
container_name: keyreg
|
|
restart: unless-stopped
|
|
environment:
|
|
TZ: ${TZ:-Europe/Lisbon}
|
|
# Interface language: pt (Portugal) or en.
|
|
UI_LANG: ${UI_LANG:-pt}
|
|
# Optional shared passcode. Leave empty and there is no gate at all —
|
|
# correct when only your Tailscale devices can reach this.
|
|
ACCESS_CODE: ${ACCESS_CODE:-}
|
|
# Reverse proxies in front (1 = NPM, 2 = Cloudflare + NPM). Empty = none.
|
|
TRUST_PROXY: ${TRUST_PROXY:-}
|
|
# Shared PIN for the /pedido request form.
|
|
REQUEST_PIN: ${REQUEST_PIN:-}
|
|
# 1 = /pedido bypasses ACCESS_CODE so outsiders can submit. See README.
|
|
PUBLIC_REQUESTS: ${PUBLIC_REQUESTS:-0}
|
|
# Set to 1 for the very first run if you want sample data to click around.
|
|
# Turn it back to 0 before entering anything real.
|
|
SEED_DEMO: ${SEED_DEMO:-0}
|
|
volumes:
|
|
# A named volume, not a bind mount. SQLite in WAL mode needs shared
|
|
# memory mapping, which Docker Desktop's file sharing on macOS and
|
|
# Windows does not support — a bind mount there fails to open the
|
|
# database, or corrupts it later. This works the same everywhere.
|
|
- keyreg_data:/data
|
|
ports:
|
|
# Localhost only. `tailscale serve --bg 3000` puts HTTPS in front.
|
|
# Change to "3000:3000" ONLY for temporary testing on your own LAN.
|
|
#
|
|
# ON A VPS WITH NGINX PROXY MANAGER: delete this whole `ports:` block and
|
|
# uncomment `networks:` below. NPM then reaches the app by container name
|
|
# over the shared Docker network, and nothing at all listens on the public
|
|
# interface — not even on localhost, where any other user on the box could
|
|
# curl it.
|
|
- "127.0.0.1:3000:3000"
|
|
|
|
# networks:
|
|
# - npm
|
|
|
|
# networks:
|
|
# npm:
|
|
# external: true
|
|
# # The network NPM already runs on. Find it with:
|
|
# # docker network ls
|
|
# # docker inspect <npm-container> -f '{{json .NetworkSettings.Networks}}'
|
|
# name: CHANGEME_npm_default
|
|
|
|
volumes:
|
|
keyreg_data:
|