Lucas Berger
b46b25b26b
- Dockerfile: build apps/pwa into the production image's ./public so the API serves the PWA on a single port (:3000) for the Pangolin/newt tunnel - docker-compose.yml: set NODE_ENV=production (mount OIDC unconditionally) and constrain OIDC_SCOPES=openid profile email offline_access (Authelia rejected the empty-default's full scopes_supported with invalid_scope) - apps/api/scripts/seed-credential.mjs: operator tool to seed member_credentials (encrypted Fastmail app password) out-of-band — fills the documented gap
53 lines
1.6 KiB
YAML
53 lines
1.6 KiB
YAML
services:
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: apps/api/Dockerfile
|
|
target: production
|
|
environment:
|
|
NODE_ENV: production
|
|
DB_HOST: mariadb
|
|
DB_PORT: 3306
|
|
DB_USER: familysync
|
|
DB_PASSWORD: ${DB_PASSWORD}
|
|
DB_NAME: familysync
|
|
OIDC_AUTH_SECRET: ${OIDC_AUTH_SECRET:-placeholder_change_me}
|
|
OIDC_ISSUER: ${OIDC_ISSUER:-}
|
|
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-familysync}
|
|
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
|
|
OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
|
|
OIDC_AUTH_EXTERNAL_URL: ${OIDC_AUTH_EXTERNAL_URL:-}
|
|
# Constrain requested scopes — @hono/oidc-auth requests ALL of the IdP's
|
|
# scopes_supported when OIDC_SCOPES is empty (Authelia then rejects with
|
|
# invalid_scope). offline_access is required for refresh-token session
|
|
# persistence (D-12/AUTH-02) and must also be allowed on the Authelia client.
|
|
OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email offline_access}
|
|
APP_PASSWORD_ENCRYPTION_KEY: ${APP_PASSWORD_ENCRYPTION_KEY:-}
|
|
depends_on:
|
|
mariadb:
|
|
condition: service_healthy
|
|
ports:
|
|
- "3000:3000"
|
|
|
|
mariadb:
|
|
image: mariadb:11
|
|
environment:
|
|
MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
|
|
MARIADB_DATABASE: familysync
|
|
MARIADB_USER: familysync
|
|
MARIADB_PASSWORD: ${DB_PASSWORD}
|
|
volumes:
|
|
- mariadb_data:/var/lib/mysql
|
|
healthcheck:
|
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
# Phase 1: present but unused; Phase 4 wires pub/sub for live list sync
|
|
|
|
volumes:
|
|
mariadb_data:
|