Stackyard/docker-compose.yml at main · SandObserver/Stackyard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
name: stackyard

services:
  stackyard:
    container_name: stackyard
    image: ghcr.io/sandobserver/stackyard:latest
    restart: unless-stopped
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - SETUID
      - SETGID
      - DAC_OVERRIDE
      - KILL
    security_opt:
      - no-new-privileges:true
    privileged: false
    mem_limit: 384m
    mem_reservation: 96m
    memswap_limit: 384m
    # An absolute ceiling, not a share. `cpu_shares` is a weight against a default
    # of 1024, so a small-looking number here means the dashboard loses the CPU to
    # every other container on the host exactly when the host is busy.
    cpus: "0.5"
    pids_limit: 256
    # PID 1 is the entrypoint shell, which does not reap orphaned processes.
    init: true
    ports:
      - "8700:80"
    # Allows the container to reach services on the host by IP (e.g. http://192.168.1.100:8989).
    # On Linux, containers cannot reach the host's LAN IP without this.
    # host-gateway is a Docker built-in that resolves to the host machine's IP.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - ./data:/data
      - ./icons:/icons
      # Optional: CPU temperature sensors
      # - /sys/class/thermal:/sys/class/thermal:ro
      # Optional: disk usage monitoring (add your mount paths)
      # - /mnt/your-drive:/mnt/your-drive:ro
    environment:
      # Set these either here, by replacing the value after the colon-dash, or in
      # a .env file beside this one, or in your Docker UI's environment editor.
      # An empty value means the built-in default.
      #
      # Socket proxy URL for Docker container health monitoring.
      - SOCKET_PROXY_URL=${SOCKET_PROXY_URL:-}
      # Set to true if behind a reverse proxy (Nginx Proxy Manager, Traefik, etc.)
      - TRUST_PROXY=${TRUST_PROXY:-}
      # Where your reverse proxy is, if you have one in front (Nginx Proxy
      # Manager, Caddy, Traefik), for example 172.18.0.0/16. Without this, every
      # request through it counts as one client for rate limiting. See
      # https://stackyard.sandobserver.com/docs/reverse-proxy/.
      - TRUSTED_PROXY=${TRUSTED_PROXY:-}
      # Memory used per password hash. Default 16mib suits small hardware;
      # raise it if you can, for example 64mib. See https://stackyard.sandobserver.com/docs/security/.
      - PASSWORD_HASH_MEMORY=${PASSWORD_HASH_MEMORY:-}
      # Turns the SSRF guard off, so badges and widgets may reach private, LAN
      # and loopback addresses. Most homelab installs need it, because the
      # services they point at live on private IPs. See https://stackyard.sandobserver.com/docs/security/.
      - ALLOW_PRIVATE_IPS=${ALLOW_PRIVATE_IPS:-}
      # Log verbosity: debug, info, warn or error, where warn and error behave
      # the same. Settings, General sets this too, and that wins once the config
      # has loaded.
      - LOG_LEVEL=${LOG_LEVEL:-}
      # Run as a read-only public showcase. See https://stackyard.sandobserver.com/docs/contributing/releasing/.
      - DEMO_MODE=${DEMO_MODE:-}
      # Idle session lifetime in days before re-login is required (default 12
      # hours). Accepts a fraction. A session in use is extended automatically,
      # up to 30 days after sign-in or this lifetime if longer.
      - SESSION_MAX_AGE_DAYS=${SESSION_MAX_AGE_DAYS:-}
      # Node sizes its heap from the host's memory, not from mem_limit above, so
      # without this the API is killed by the kernel instead of collecting. Keep
      # it near half of mem_limit, and raise both together.
      - NODE_OPTIONS=${NODE_OPTIONS:---max-old-space-size=192}
      # Internal paths. Change only if you have moved them.
      # - CONFIG_PATH=/data/apps.json
      # - ICONS_PATH=/icons
      # - WIDGETS_PATH=/usr/share/nginx/html/widgets
      # PORT does not change anything inside the container: nginx serves on 80 and
      # supervisord pins the API to 3000. Set it only for a hosting platform that
      # reads PORT to decide where to route, and give it 80. To reach the
      # dashboard on a different port, change the mapping under `ports:` above.
      # - PORT=80
    healthcheck:
      test:
        - CMD
        - wget
        - "-qO-"
        - http://localhost/health
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - stackyard_network
      # Add your reverse proxy network here, e.g.:
      # - proxy-net

networks:
  stackyard_network:
    name: stackyard_network
    driver: bridge
  # proxy-net:
  #   name: proxy-net
  #   external: true