jeremy
8715589cbb
- /admin: first-visit password setup (scrypt), signed 30-day session cookie, calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test, history (20) with restore; /photo-admin -> /admin#photos placeholder - settings in local /data (settings.json + auth.json + history/), seeded once from the calendar secret; dashboard + health read from settings - start.mjs drops privileges after reading secrets and runs a front proxy that stamps the real client IP; admin refuses non-LAN and proxied requests - deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
65 lines
2.1 KiB
YAML
65 lines
2.1 KiB
YAML
name: hobbs-family-organizer
|
|
|
|
services:
|
|
organizer:
|
|
image: hobbs-family-organizer:1.1.0
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
restart: unless-stopped
|
|
init: true
|
|
environment:
|
|
NODE_ENV: production
|
|
HOSTNAME: 0.0.0.0
|
|
PORT: "3000"
|
|
TZ: ${ORGANIZER_TIMEZONE:-America/Chicago}
|
|
ORGANIZER_TIMEZONE: ${ORGANIZER_TIMEZONE:-America/Chicago}
|
|
WEATHER_LOCATION: ${WEATHER_LOCATION:-Sapulpa, OK}
|
|
WEATHER_LATITUDE: ${WEATHER_LATITUDE:-35.9987}
|
|
WEATHER_LONGITUDE: ${WEATHER_LONGITUDE:--96.11417}
|
|
NWS_FORECAST_URL: ${NWS_FORECAST_URL:-https://api.weather.gov/gridpoints/TSA/37,98/forecast}
|
|
WEATHER_USER_AGENT: ${WEATHER_USER_AGENT:-Hobbs-Family-Organizer/1.0 (self-hosted)}
|
|
CALENDAR_ICAL_URLS_FILE: /run/secrets/calendar_ical_urls
|
|
ORGANIZER_ACCESS_TOKEN_FILE: /run/secrets/organizer_access_token
|
|
ORGANIZER_DATA_DIR: /data
|
|
ADMIN_ALLOWED_CIDRS: ${ADMIN_ALLOWED_CIDRS:-192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,127.0.0.1/32}
|
|
secrets:
|
|
- calendar_ical_urls
|
|
- organizer_access_token
|
|
ports:
|
|
- "${HOBBS_BIND_ADDRESS:-0.0.0.0}:${HOBBS_HTTP_PORT:-8080}:3000"
|
|
volumes:
|
|
# Admin settings, password hash and history. Must be writable by uid 10001,
|
|
# and must be local disk (not NFS with root_squash).
|
|
- ${HOBBS_DATA_DIR:-./data}:/data
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=64m,mode=1777
|
|
- /app/.next-build/cache:size=128m,uid=10001,gid=10001,mode=0750
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- SETGID
|
|
- SETUID
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
pids_limit: 128
|
|
stop_grace_period: 20s
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: 10m
|
|
max-file: "3"
|
|
|
|
secrets:
|
|
calendar_ical_urls:
|
|
file: ./secrets/calendar_ical_urls.json
|
|
organizer_access_token:
|
|
file: ./secrets/organizer_access_token.txt
|