40 lines
1.5 KiB
YAML
40 lines
1.5 KiB
YAML
# Interface web :
|
|
# docker compose up -d # http://<hôte>:8080
|
|
# Base vide : la page de connexion crée le premier administrateur (ne pas exposer
|
|
# l'instance avant), sauf si CONFSYNC_ADMIN_PASSWORD(_FILE) est fourni.
|
|
# Clusters, mots de passe root (chiffrés en base) et réglages : tout se fait dans l'UI.
|
|
services:
|
|
confsync:
|
|
build: .
|
|
image: pve-confsync:dev
|
|
container_name: pve-confsync
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8080:8080" # ou derrière Traefik (HTTPS : cookies Secure)
|
|
environment:
|
|
TZ: ${TZ:-Europe/Paris}
|
|
CONFSYNC_SECRET_KEY_FILE: /run/secrets/confsync_key # clé AES des mots de passe en base, hors volume /data
|
|
# CONFSYNC_ADMIN_PASSWORD_FILE: /run/secrets/confsync_admin
|
|
# OIDC_ISSUER: https://auth.example.org/application/o/confsync/
|
|
# OIDC_CLIENT_ID: confsync
|
|
# OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client
|
|
# OIDC_REDIRECT_URL: https://confsync.example.org/auth/callback
|
|
# OIDC_ADMIN_GROUP: confsync-admins
|
|
# OIDC_OPERATOR_GROUP: confsync-operators
|
|
env_file:
|
|
- path: .env
|
|
required: false
|
|
volumes:
|
|
- confsync-data:/data # SQLite, session.key
|
|
secrets:
|
|
- confsync_key
|
|
|
|
# Fichier chmod 600, propriétaire 10001, monté dans /run/secrets/confsync_key.
|
|
# mkdir -p secrets && openssl rand -hex 32 > secrets/confsync_key
|
|
secrets:
|
|
confsync_key:
|
|
file: ./secrets/confsync_key
|
|
|
|
volumes:
|
|
confsync-data:
|