update 26.09.26
This commit is contained in:
@@ -0,0 +1,107 @@
|
||||
# Docker image to run. Pin a sha-* tag or @sha256 digest for stricter deploys.
|
||||
APP_IMAGE=ghcr.io/bookorbit/bookorbit:latest
|
||||
|
||||
# App publish port on host
|
||||
# For access only from this host (such as a host reverse proxy), use 127.0.0.1:3000.
|
||||
APP_PORT=2600
|
||||
|
||||
# Optional listen address inside the container (IPv4 or IPv6, without brackets).
|
||||
# Keep the default for bridge networking; use APP_PORT above to restrict host exposure.
|
||||
# HOST=0.0.0.0
|
||||
|
||||
# Host folder that appears as /books in the container.
|
||||
# Point this at your library root; use an absolute path on NAS/Portainer installs.
|
||||
BOOKS_HOST_PATH=/volume2/docker/docker_projects/bookorbit/books
|
||||
APP_DATA_HOST_PATH=/volume2/docker/docker_projects/bookorbit/data/app
|
||||
POSTGRES_DATA_HOST_PATH=/volume2/docker/docker_projects/bookorbit/data/postgres
|
||||
|
||||
# Container runtime UID/GID for files written to app-managed data folders.
|
||||
# Most users can leave these defaults.
|
||||
PUID=1000
|
||||
PGID=1000
|
||||
|
||||
# Database credentials
|
||||
POSTGRES_USER=bookorbit
|
||||
POSTGRES_PASSWORD=change-this-password
|
||||
POSTGRES_DB=bookorbit
|
||||
|
||||
# App secrets
|
||||
JWT_SECRET=change-this-to-a-long-random-secret
|
||||
# Fresh installs should generate an independent key with: openssl rand -hex 32
|
||||
# Existing installs upgrading from an older release must initially copy their current JWT_SECRET here so existing podcast URLs remain readable.
|
||||
PODCAST_ENCRYPTION_KEY=change-this-to-a-different-long-random-secret
|
||||
# Required for the initial /auth/setup endpoint (x-setup-token header)
|
||||
SETUP_BOOTSTRAP_TOKEN=change-this-to-a-long-random-secret
|
||||
|
||||
# Sensitive values can instead be read from mounted files by appending _FILE.
|
||||
# Leave the direct value blank, then set its _FILE variable to the container path.
|
||||
# Keep the blank assignment: docker-compose.yml requires these keys to be present.
|
||||
# A non-empty direct value and its _FILE variable are mutually exclusive.
|
||||
# The file must be mounted into every service that uses it, and must not be empty.
|
||||
# POSTGRES_PASSWORD_FILE=/run/secrets/bookorbit_postgres_password
|
||||
# JWT_SECRET_FILE=/run/secrets/bookorbit_jwt_secret
|
||||
# PODCAST_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_podcast_encryption_key
|
||||
# SETUP_BOOTSTRAP_TOKEN_FILE=/run/secrets/bookorbit_setup_bootstrap_token
|
||||
|
||||
# External/public URL used by emails and Kobo endpoints
|
||||
APP_URL=https://bookorbit.example.com
|
||||
|
||||
# Node.js JavaScript heap limit in MB. Raise this for very large libraries, 250K+ books.
|
||||
NODE_MAX_OLD_SPACE_SIZE=2048
|
||||
|
||||
# --- Optional overrides (uncomment to set) ---
|
||||
|
||||
# If you already run your own PostgreSQL, set DATABASE_URL and remove the
|
||||
# postgres service from docker-compose.yml. Your instance must have the
|
||||
# uuid-ossp, pg_trgm, and vector (pgvector) extensions available.
|
||||
# DATABASE_URL=postgres://user:password@yourhost:5432/bookorbit
|
||||
# DATABASE_URL_FILE=/run/secrets/bookorbit_database_url
|
||||
# Or set individual parts (POSTGRES_HOST, POSTGRES_PORT, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB)
|
||||
|
||||
# CORS origin for the frontend when served from a different domain than APP_URL
|
||||
# CLIENT_URL=https://app.example.com
|
||||
|
||||
# Container folder used as the top of the library creation folder picker.
|
||||
# Defaults to / when unset. Set to /books to hide other container root folders.
|
||||
# LIBRARY_BROWSE_ROOT=/books
|
||||
|
||||
# Set to false only if your platform manages bind mount ownership externally.
|
||||
# BOOKORBIT_FIX_PERMISSIONS=true
|
||||
|
||||
# Recommended if you store SMTP provider credentials (generate: openssl rand -hex 32)
|
||||
# EMAIL_ENCRYPTION_KEY=
|
||||
# EMAIL_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_email_encryption_key
|
||||
|
||||
# Recommended if you store migration source credentials (generate: openssl rand -hex 32)
|
||||
# MIGRATION_ENCRYPTION_KEY=
|
||||
# MIGRATION_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_migration_encryption_key
|
||||
|
||||
# Required before download-client or indexer credentials can be saved.
|
||||
# BOOK_REQUEST_ENCRYPTION_KEY=
|
||||
# BOOK_REQUEST_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_book_request_encryption_key
|
||||
|
||||
# Optional GitHub token used to read release notes, raising the anonymous API rate limit.
|
||||
# GITHUB_RELEASES_TOKEN=
|
||||
# GITHUB_RELEASES_TOKEN_FILE=/run/secrets/bookorbit_github_releases_token
|
||||
|
||||
# Absolute container path that authorizes local migration backup files.
|
||||
# Mount a dedicated host directory at this path as read-only before enabling backup mode.
|
||||
# MIGRATION_IMPORT_ROOT=/imports
|
||||
|
||||
# Log level (default: info). Set to debug for verbose output.
|
||||
# LOG_LEVEL=info
|
||||
|
||||
# Allow OIDC issuer/discovery URLs that resolve to private/local addresses.
|
||||
# Default false. Enable only in trusted self-hosted networks.
|
||||
# OIDC_ALLOW_LOCAL_ISSUERS=false
|
||||
# Trust additional PEM-encoded certificate authorities for outbound TLS, including OIDC.
|
||||
# Mount the CA bundle read-only, set its in-container path here, and restart BookOrbit.
|
||||
# NODE_EXTRA_CA_CERTS=/path/to/private-ca-bundle.pem
|
||||
|
||||
# Disable username/password sign-in after at least one active administrator has linked an enabled
|
||||
# OIDC provider. Set false and restart to recover access if the identity provider is unavailable.
|
||||
# DISABLE_LOCAL_AUTH=false
|
||||
|
||||
# Optional: allow Cloudflare Web Analytics beacon when using automatic setup.
|
||||
# Keep unset/false to preserve strict CSP (`script-src 'self'`).
|
||||
# CSP_ALLOW_CLOUDFLARE_INSIGHTS=false
|
||||
@@ -0,0 +1,96 @@
|
||||
name: bookorbit
|
||||
|
||||
services:
|
||||
app:
|
||||
container_name: bookorbit-app
|
||||
image: ${APP_IMAGE?required}
|
||||
restart: unless-stopped
|
||||
init: true
|
||||
env_file:
|
||||
- .env
|
||||
ports:
|
||||
- "${APP_PORT:-3000}:${PORT:-3000}"
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
PORT: ${PORT:-3000}
|
||||
DATABASE_URL: ${DATABASE_URL:-}
|
||||
POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
|
||||
POSTGRES_PORT: ${POSTGRES_PORT:-5432}
|
||||
POSTGRES_USER: ${POSTGRES_USER?required}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD?required}
|
||||
POSTGRES_DB: ${POSTGRES_DB?required}
|
||||
JWT_SECRET: ${JWT_SECRET?required}
|
||||
PODCAST_ENCRYPTION_KEY: ${PODCAST_ENCRYPTION_KEY:-}
|
||||
SETUP_BOOTSTRAP_TOKEN: ${SETUP_BOOTSTRAP_TOKEN?required}
|
||||
APP_URL: ${APP_URL?required}
|
||||
CLIENT_URL: ${CLIENT_URL:-${APP_URL?required}}
|
||||
TZ: ${TZ:-UTC}
|
||||
PUID: ${PUID:-1000}
|
||||
PGID: ${PGID:-1000}
|
||||
NODE_MAX_OLD_SPACE_SIZE: ${NODE_MAX_OLD_SPACE_SIZE:-auto}
|
||||
BOOK_DOCK_PATH: ${BOOK_DOCK_PATH:-}
|
||||
LIBRARY_BROWSE_ROOT: ${LIBRARY_BROWSE_ROOT:-}
|
||||
DISABLE_LOCAL_AUTH: ${DISABLE_LOCAL_AUTH:-false}
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
volumes:
|
||||
- ${BOOKS_HOST_PATH:-./books}:/books
|
||||
- ${APP_DATA_HOST_PATH:-./data/app}:/data
|
||||
read_only: true
|
||||
tmpfs:
|
||||
- /tmp
|
||||
cap_drop:
|
||||
- ALL
|
||||
cap_add:
|
||||
- CHOWN
|
||||
- DAC_OVERRIDE
|
||||
- FOWNER
|
||||
- SETGID
|
||||
- SETUID
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
stop_grace_period: 30s
|
||||
|
||||
# Opt-in: add `--profile tts` to your compose commands. BookOrbit reaches it inside the compose
|
||||
# network at http://kokoro:8880/v1, so no port is published to the host.
|
||||
kokoro:
|
||||
container_name: bookorbit-kokoro
|
||||
image: ${KOKORO_IMAGE:-ghcr.io/remsky/kokoro-fastapi-cpu:v0.8.0}
|
||||
profiles: ["tts"]
|
||||
restart: unless-stopped
|
||||
init: true
|
||||
expose:
|
||||
- "8880"
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
stop_grace_period: 30s
|
||||
healthcheck:
|
||||
test:
|
||||
[
|
||||
"CMD-SHELL",
|
||||
'python -c "import urllib.request;urllib.request.urlopen(''http://127.0.0.1:8880/v1/audio/voices'')"',
|
||||
]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 5
|
||||
start_period: 60s
|
||||
|
||||
postgres:
|
||||
container_name: bookorbit-db
|
||||
image: pgvector/pgvector:pg18
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
POSTGRES_USER: ${POSTGRES_USER?required}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD?required}
|
||||
POSTGRES_DB: ${POSTGRES_DB?required}
|
||||
PGDATA: /var/lib/postgresql/data/pgdata
|
||||
volumes:
|
||||
- ${POSTGRES_DATA_HOST_PATH:-./data/postgres}:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test:
|
||||
["CMD-SHELL", 'pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"']
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 20s
|
||||
Reference in New Issue
Block a user