siliconsolder
079013730b
- Proxy notification image_url server-side (GET /api/v1/notifications/:id/image) instead of loading it directly in the browser, so LAN-only image sources (e.g. Frigate snapshots) still load for clients off that network - Tighten CSP img-src to 'self' now that images are same-origin - Update threat model / architecture docs to match the new image-fetch design - Expand README: Home Assistant quick-start, Pocket ID/OIDC walkthrough, Pangolin note, backup automation, new troubleshooting entries - Fix docker-compose.yml: document that --env-file .env must be passed explicitly (Compose's implicit .env lookup was unreliable with -f from a different directory) - Fix image-proxy tests to build a real session cookie (AUTH_MODE=oidc applies inside the test container too, so requireAuth needs one)
91 lines
3.7 KiB
YAML
91 lines
3.7 KiB
YAML
# Dev stack: hot-reload container + Postgres, for local development on this
|
|
# machine. NOT what gets deployed to Unraid — see docker-compose.prod.yml
|
|
# and docs/phase1/06-docker-unraid-design.md for that.
|
|
#
|
|
# Run from the repo root, ALWAYS with --env-file .env explicitly — Compose's
|
|
# implicit .env lookup when a compose file is passed via -f from a
|
|
# different directory is ambiguous/version-dependent, and got this wrong at
|
|
# least once. Don't rely on it:
|
|
# docker compose --env-file .env -f docker/docker-compose.yml up -d
|
|
#
|
|
# Copy .env.example to .env in the repo root and fill in real values first.
|
|
# Every other docker compose invocation against this file (exec, logs,
|
|
# restart, ...) needs the same --env-file .env flag, not just `up`.
|
|
#
|
|
# Host ports are overridable (Unraid boxes commonly already have something
|
|
# on 8080/5432) — e.g.:
|
|
# HOST_PORT_WEB=18080 HOST_PORT_INGEST=18081 HOST_PORT_PG=15432 \
|
|
# docker compose --env-file .env -f docker/docker-compose.yml up -d
|
|
# or put those in the same .env file so you don't have to repeat them.
|
|
#
|
|
# IMPORTANT: whenever a package.json dependency changes, `--build` alone is
|
|
# not enough — Compose reuses the OLD container's anonymous node_modules
|
|
# volumes by default instead of repopulating them from the rebuilt image.
|
|
# Use:
|
|
# docker compose --env-file .env -f docker/docker-compose.yml up -d --build --force-recreate -V
|
|
# (-V / --renew-anon-volumes forces those volumes to be recreated from the
|
|
# new image; it does not touch the named notizarr_dev_pgdata volume below.)
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
container_name: notizarr-postgres-dev
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-notizarr}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
|
|
POSTGRES_DB: ${POSTGRES_DB:-notizarr}
|
|
ports:
|
|
- "127.0.0.1:${HOST_PORT_PG:-15432}:5432"
|
|
volumes:
|
|
- notizarr_dev_pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-notizarr} -d ${POSTGRES_DB:-notizarr}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
notizarr:
|
|
build:
|
|
context: ..
|
|
dockerfile: apps/server/Dockerfile
|
|
target: dev
|
|
container_name: notizarr-dev
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
NODE_ENV: development
|
|
PORT_WEB: "8080"
|
|
PORT_INGEST: "8081"
|
|
PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:?set PUBLIC_BASE_URL in .env}
|
|
DATABASE_URL: postgres://${POSTGRES_USER:-notizarr}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/${POSTGRES_DB:-notizarr}
|
|
LOG_LEVEL: ${LOG_LEVEL:-debug}
|
|
AUTH_MODE: ${AUTH_MODE:-disabled}
|
|
INGESTION_ALLOWED_CIDRS: ${INGESTION_ALLOWED_CIDRS:-0.0.0.0/0}
|
|
# Apple's push service (web.push.apple.com) rejects VAPID JWTs whose
|
|
# `sub` claim isn't a real mailto:/https: value with a 403 — the
|
|
# config.ts fallback (mailto:admin@localhost) trips exactly that.
|
|
VAPID_SUBJECT: ${VAPID_SUBJECT:?set VAPID_SUBJECT in .env}
|
|
ports:
|
|
- "${HOST_PORT_WEB:-18080}:8080"
|
|
- "${HOST_PORT_INGEST:-18081}:8081"
|
|
volumes:
|
|
- ..:/workspace
|
|
# Anonymous volumes over node_modules so the bind mount above doesn't
|
|
# shadow the dependencies installed into the image at build time.
|
|
- /workspace/node_modules
|
|
- /workspace/apps/server/node_modules
|
|
- /workspace/apps/web/node_modules
|
|
- /workspace/packages/shared/node_modules
|
|
healthcheck:
|
|
test: ["CMD", "node", "apps/server/healthcheck.js"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
|
|
volumes:
|
|
notizarr_dev_pgdata:
|