main
|
Last change
on this file since 520c993 was f99bbe8, checked in by Robin Genis <roboburr@…>, 3 months ago |
|
security: bind to 127.0.0.1 by default behind a reverse proxy
New HOST env (default 0.0.0.0 for Docker/back-compat). The VPS installer now
writes HOST=127.0.0.1 and Docker maps the host port to loopback (127.0.0.1:3000:3000)
+ overrides HOST=0.0.0.0 inside the container — so the app is never reachable
directly on its port from the internet, only via the proxy. .env.example defaults
to 127.0.0.1 (manual installs); docs explain it. Existing installs hardened on
re-run of install.sh.
Co-Authored-By: Claude <noreply@…>
|
-
Property mode
set to
100644
|
|
File size:
1.3 KB
|
| Line | |
|---|
| 1 | # Klonkt — self-host with Docker Compose.
|
|---|
| 2 | #
|
|---|
| 3 | # 1. cp .env.example .env (works as-is: SESSION_SECRET is auto-generated;
|
|---|
| 4 | # optionally set PUBLIC_BASE_URL to your domain so
|
|---|
| 5 | # email/login links are correct)
|
|---|
| 6 | # 2. docker compose up -d
|
|---|
| 7 | # 3. open your site and create your admin account at /auth/register
|
|---|
| 8 | #
|
|---|
| 9 | # The app listens on port 3000. Put a reverse proxy (Caddy/nginx) in front for
|
|---|
| 10 | # HTTPS on your domain — see README.
|
|---|
| 11 | services:
|
|---|
| 12 | klonkt:
|
|---|
| 13 | build: .
|
|---|
| 14 | image: klonkt:latest
|
|---|
| 15 | restart: unless-stopped
|
|---|
| 16 | env_file: .env
|
|---|
| 17 | environment:
|
|---|
| 18 | # Inside the container it always runs on port 3000 in production mode and
|
|---|
| 19 | # binds all interfaces (so the port mapping works) — overrides .env. The
|
|---|
| 20 | # loopback host-mapping below is what keeps it off the public internet.
|
|---|
| 21 | NODE_ENV: production
|
|---|
| 22 | PORT: "3000"
|
|---|
| 23 | HOST: "0.0.0.0"
|
|---|
| 24 | ports:
|
|---|
| 25 | # Bind the host port to loopback only — reach the app through your reverse
|
|---|
| 26 | # proxy (Caddy/nginx) on this host, not directly from the internet.
|
|---|
| 27 | # Change the left side if 3000 is taken, e.g. "127.0.0.1:3001:3000".
|
|---|
| 28 | - "127.0.0.1:3000:3000"
|
|---|
| 29 | volumes:
|
|---|
| 30 | # All data (database, uploaded media + audio) is kept here.
|
|---|
| 31 | - klonkt-data:/app/storage
|
|---|
| 32 |
|
|---|
| 33 | volumes:
|
|---|
| 34 | klonkt-data:
|
|---|
Note:
See
TracBrowser
for help on using the repository browser.