yuvomi/podman-compose.yml at main · ulsklyc/yuvomi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# Podman-Compose-Manifest für Yuvomi (RHEL/Fedora/CentOS Stream, rootless + SELinux).
# Nutzbar mit `podman compose -f podman-compose.yml up -d` (Podman 4.1+) oder
# `podman-compose -f podman-compose.yml up -d`. Der Web-/CLI-Installer wählt das
# Manifest automatisch, wenn nur Podman vorhanden ist.
#
# Unterschiede zu docker-compose.yml:
#   - Bind-Mounts tragen `:Z` (privates SELinux-Relabel pro Container), sonst
#     verweigert SELinux im Enforcing-Modus den Zugriff auf /data, /backups, …
#   - Die Host-Bind-Adresse ist über OIKOS_HTTP_BIND konfigurierbar (Default
#     0.0.0.0). Rootless hinter einem Reverse-Proxy: OIKOS_HTTP_BIND=127.0.0.1.
services:
  yuvomi:
    image: ghcr.io/ulsklyc/yuvomi:latest
    build: .                          # optional: use --build to build locally instead
    container_name: yuvomi
    restart: unless-stopped
    ports:
      # Host-Bind aus .env (OIKOS_HTTP_BIND, Default 0.0.0.0) + Host-Port
      # (OIKOS_HTTP_PORT). App im Container bleibt auf 3000.
      - "${OIKOS_HTTP_BIND:-0.0.0.0}:${OIKOS_HTTP_PORT:-3000}:3000"
    volumes:
      # `:Z` = privates SELinux-Relabel. Nur setzen, wenn die Verzeichnisse
      # ausschließlich von diesem Container genutzt werden (hier der Fall).
      - ${DATA_DIR:-./data}:/data:Z
      - ${BACKUP_DIR:-./backups}:/backups:Z
      # Drop Yuvomi modules into ./modules, or set MODULES_DIR=/path/to/modules in
      # .env. The app reads that name inside the container too, so environment:
      # below pins it to /app/modules; the .env value only moves the mount source.
      - ${MODULES_DIR:-./modules}:/app/modules:Z
      # Optional local documents folder. BOTH ends come from the .env: the app
      # writes to DOCUMENT_STORAGE_LOCAL_PATH, so mounting at a fixed /documents
      # would send uploads into the container layer as soon as anyone changes
      # that path - and they would be gone on the next pull && up -d.
      - ${DOCUMENT_STORAGE_LOCAL_DIR:-./documents}:${DOCUMENT_STORAGE_LOCAL_PATH:-/documents}:Z
    # Bewusst die KURZFORM, anders als in docker-compose.yml: dort steht seit
    # Issue #698 `path:`/`required: false`, damit Git-managed Stacks ohne .env
    # deployen. podman-compose kennt diese Objektform erst ab 1.2.0 (PR #925,
    # Mai 2024) und stirbt davor am Parsen - RHEL 9 liefert noch 1.0.6 aus. Für
    # den Podman-Pfad kauft die Langform auch nichts: hier legt der Installer
    # die .env immer an, und Git-/GitOps-Oberflächen fahren Docker.
    env_file:
      - .env
    environment:
      - NODE_ENV=production
      - DB_PATH=${DB_PATH:-/data/yuvomi.db}
      - BACKUP_DIR=/backups
      - MODULES_DIR=/app/modules
      # Local document storage (optional): set to true to store uploaded documents on the mounted /documents folder.
      - DOCUMENT_STORAGE_LOCAL_ENABLED=${DOCUMENT_STORAGE_LOCAL_ENABLED:-false}
      - DOCUMENT_STORAGE_LOCAL_PATH=${DOCUMENT_STORAGE_LOCAL_PATH:-/documents}
      # Secure cookies come from .env (the installer sets them):
      #   - Reverse proxy + HTTPS → SESSION_SECURE=true, TRUST_PROXY=1
      #   - Direct HTTP access     → SESSION_SECURE=false, TRUST_PROXY=loopback
      # Default when unset (e.g. bare `podman compose up` without .env): false,
      # so direct HTTP login keeps working out of the box.
      - SESSION_SECURE=${SESSION_SECURE:-false}
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health', r => process.exit(r.statusCode === 200 ? 0 : 1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s