update 26.09.26

2026-09-26 01:04:38 +08:00
parent 68b9934f08
commit bb826c05ce
9 changed files with 229 additions and 265 deletions
@@ -0,0 +1,107 @@
+# Docker image to run. Pin a sha-* tag or @sha256 digest for stricter deploys.
+APP_IMAGE=ghcr.io/bookorbit/bookorbit:latest
+
+# App publish port on host
+# For access only from this host (such as a host reverse proxy), use 127.0.0.1:3000.
+APP_PORT=2600
+
+# Optional listen address inside the container (IPv4 or IPv6, without brackets).
+# Keep the default for bridge networking; use APP_PORT above to restrict host exposure.
+# HOST=0.0.0.0
+
+# Host folder that appears as /books in the container.
+# Point this at your library root; use an absolute path on NAS/Portainer installs.
+BOOKS_HOST_PATH=/volume2/docker/docker_projects/bookorbit/books
+APP_DATA_HOST_PATH=/volume2/docker/docker_projects/bookorbit/data/app
+POSTGRES_DATA_HOST_PATH=/volume2/docker/docker_projects/bookorbit/data/postgres
+
+# Container runtime UID/GID for files written to app-managed data folders.
+# Most users can leave these defaults.
+PUID=1000
+PGID=1000
+
+# Database credentials
+POSTGRES_USER=bookorbit
+POSTGRES_PASSWORD=change-this-password
+POSTGRES_DB=bookorbit
+
+# App secrets
+JWT_SECRET=change-this-to-a-long-random-secret
+# Fresh installs should generate an independent key with: openssl rand -hex 32
+# Existing installs upgrading from an older release must initially copy their current JWT_SECRET here so existing podcast URLs remain readable.
+PODCAST_ENCRYPTION_KEY=change-this-to-a-different-long-random-secret
+# Required for the initial /auth/setup endpoint (x-setup-token header)
+SETUP_BOOTSTRAP_TOKEN=change-this-to-a-long-random-secret
+
+# Sensitive values can instead be read from mounted files by appending _FILE.
+# Leave the direct value blank, then set its _FILE variable to the container path.
+# Keep the blank assignment: docker-compose.yml requires these keys to be present.
+# A non-empty direct value and its _FILE variable are mutually exclusive.
+# The file must be mounted into every service that uses it, and must not be empty.
+# POSTGRES_PASSWORD_FILE=/run/secrets/bookorbit_postgres_password
+# JWT_SECRET_FILE=/run/secrets/bookorbit_jwt_secret
+# PODCAST_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_podcast_encryption_key
+# SETUP_BOOTSTRAP_TOKEN_FILE=/run/secrets/bookorbit_setup_bootstrap_token
+
+# External/public URL used by emails and Kobo endpoints
+APP_URL=https://bookorbit.example.com
+
+# Node.js JavaScript heap limit in MB. Raise this for very large libraries, 250K+ books.
+NODE_MAX_OLD_SPACE_SIZE=2048
+
+# --- Optional overrides (uncomment to set) ---
+
+# If you already run your own PostgreSQL, set DATABASE_URL and remove the
+# postgres service from docker-compose.yml. Your instance must have the
+# uuid-ossp, pg_trgm, and vector (pgvector) extensions available.
+# DATABASE_URL=postgres://user:password@yourhost:5432/bookorbit
+# DATABASE_URL_FILE=/run/secrets/bookorbit_database_url
+# Or set individual parts (POSTGRES_HOST, POSTGRES_PORT, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB)
+
+# CORS origin for the frontend when served from a different domain than APP_URL
+# CLIENT_URL=https://app.example.com
+
+# Container folder used as the top of the library creation folder picker.
+# Defaults to / when unset. Set to /books to hide other container root folders.
+# LIBRARY_BROWSE_ROOT=/books
+
+# Set to false only if your platform manages bind mount ownership externally.
+# BOOKORBIT_FIX_PERMISSIONS=true
+
+# Recommended if you store SMTP provider credentials (generate: openssl rand -hex 32)
+# EMAIL_ENCRYPTION_KEY=
+# EMAIL_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_email_encryption_key
+
+# Recommended if you store migration source credentials (generate: openssl rand -hex 32)
+# MIGRATION_ENCRYPTION_KEY=
+# MIGRATION_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_migration_encryption_key
+
+# Required before download-client or indexer credentials can be saved.
+# BOOK_REQUEST_ENCRYPTION_KEY=
+# BOOK_REQUEST_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_book_request_encryption_key
+
+# Optional GitHub token used to read release notes, raising the anonymous API rate limit.
+# GITHUB_RELEASES_TOKEN=
+# GITHUB_RELEASES_TOKEN_FILE=/run/secrets/bookorbit_github_releases_token
+
+# Absolute container path that authorizes local migration backup files.
+# Mount a dedicated host directory at this path as read-only before enabling backup mode.
+# MIGRATION_IMPORT_ROOT=/imports
+
+# Log level (default: info). Set to debug for verbose output.
+# LOG_LEVEL=info
+
+# Allow OIDC issuer/discovery URLs that resolve to private/local addresses.
+# Default false. Enable only in trusted self-hosted networks.
+# OIDC_ALLOW_LOCAL_ISSUERS=false
+# Trust additional PEM-encoded certificate authorities for outbound TLS, including OIDC.
+# Mount the CA bundle read-only, set its in-container path here, and restart BookOrbit.
+# NODE_EXTRA_CA_CERTS=/path/to/private-ca-bundle.pem
+
+# Disable username/password sign-in after at least one active administrator has linked an enabled
+# OIDC provider. Set false and restart to recover access if the identity provider is unavailable.
+# DISABLE_LOCAL_AUTH=false
+
+# Optional: allow Cloudflare Web Analytics beacon when using automatic setup.
+# Keep unset/false to preserve strict CSP (`script-src 'self'`).
+# CSP_ALLOW_CLOUDFLARE_INSIGHTS=false