73 lines
2.4 KiB
YAML
73 lines
2.4 KiB
YAML
# Production stack.
|
|
#
|
|
# docker compose -f docker-compose.prod.yml up -d
|
|
#
|
|
# No reverse proxy here by design: TLS is terminated by the central reverse
|
|
# proxy on a separate machine, which connects to the published port below over
|
|
# the LAN. Example proxy configs for that machine live in docker/reverse-proxy/.
|
|
#
|
|
# Add `--profile syncthing` to also run Syncthing in this stack; omit it if
|
|
# Syncthing already runs on the host and merely shares VAULT_PATH.
|
|
|
|
services:
|
|
markdown-to-caldav:
|
|
build: .
|
|
image: markdown-to-caldav:latest
|
|
container_name: markdown-to-caldav
|
|
restart: unless-stopped
|
|
|
|
# Must match the uid/gid that owns the vault (the Syncthing folder), or
|
|
# write-back fails and Syncthing sees permission churn.
|
|
user: "${VAULT_UID:?set VAULT_UID}:${VAULT_GID:?set VAULT_GID}"
|
|
|
|
ports:
|
|
# Reachable by the reverse-proxy machine over the LAN. BIND_ADDRESS
|
|
# defaults to all interfaces; set it to this host's LAN address to avoid
|
|
# listening anywhere else. Restrict to the proxy's IP at the firewall —
|
|
# this port is plain HTTP and speaks for your notes.
|
|
- "${BIND_ADDRESS:-0.0.0.0}:${BIND_PORT:-5233}:5232"
|
|
|
|
volumes:
|
|
- ${VAULT_PATH:?set VAULT_PATH}:/vault
|
|
- ./docker:/config:ro
|
|
- ./data:/data
|
|
|
|
environment:
|
|
MDCALDAV_CONFIG: /config/mdcaldav.toml
|
|
|
|
# Hardening. The app writes only to /vault and /data; everything else can
|
|
# be immutable.
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=64m
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
mem_limit: 512m
|
|
cpus: 1.0
|
|
logging: &logging
|
|
driver: json-file
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
# Optional: run Syncthing here too, sharing the vault and uid.
|
|
syncthing:
|
|
image: syncthing/syncthing:latest
|
|
container_name: mdcaldav-syncthing
|
|
profiles: [syncthing]
|
|
restart: unless-stopped
|
|
user: "${VAULT_UID:?set VAULT_UID}:${VAULT_GID:?set VAULT_GID}"
|
|
hostname: mdcaldav-syncthing
|
|
volumes:
|
|
- ${VAULT_PATH:?set VAULT_PATH}:/var/syncthing/vault
|
|
- syncthing-config:/var/syncthing/config
|
|
ports:
|
|
- "${BIND_ADDRESS:-0.0.0.0}:8384:8384" # web UI — firewall this too
|
|
- "22000:22000/tcp" # sync protocol
|
|
- "22000:22000/udp"
|
|
- "21027:21027/udp" # discovery
|
|
logging: *logging
|
|
|
|
volumes:
|
|
syncthing-config:
|