termul/docker-compose.yml at dev · gnoviawan/termul · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# termul-server in a container. Guide: docs/deployment-guide.md, "Run in Docker".
#
#   mkdir -p workspace
#   docker compose up -d
#   docker compose exec termul-server cat /home/termul/.local/state/termul/web-auth-token
#
# Then open http://localhost:8080/#token=<token>.
#
# Optional settings come from the shell or a .env file next to this file:
# TERMUL_PORT, TERMUL_WORKSPACE, TERMUL_IMAGE, TERMUL_WEB_AUTH_TOKEN,
# TERMUL_ALLOWED_ORIGINS, and, for `docker compose build`, TERMUL_RELEASE,
# TERMUL_UID, and TERMUL_GID.

name: termul

services:
  termul-server:
    image: ${TERMUL_IMAGE:-ghcr.io/gnoviawan/termul-server:latest}
    build:
      context: .
      args:
        TERMUL_RELEASE: ${TERMUL_RELEASE:-latest}
        TERMUL_UID: ${TERMUL_UID:-1000}
        TERMUL_GID: ${TERMUL_GID:-1000}
    restart: unless-stopped
    ports:
      # Loopback only. "8080:8080" or "0.0.0.0:8080:8080" publishes the server
      # on every network the host is on. The auth token still applies, but the
      # server speaks plain HTTP, so the token crosses the network unencrypted.
      # For remote access, put an HTTPS reverse proxy in front instead.
      - "127.0.0.1:${TERMUL_PORT:-8080}:8080"
    environment:
      # Empty: the server generates a token on first start and keeps it in the
      # termul-home volume. A value here replaces that token.
      TERMUL_WEB_AUTH_TOKEN: ${TERMUL_WEB_AUTH_TOKEN:-}
      # The public origin of a reverse proxy that rewrites the Host header,
      # for example https://termul.example.com. Comma-separate several.
      TERMUL_ALLOWED_ORIGINS: ${TERMUL_ALLOWED_ORIGINS:-}
      # Requests reach the container from the Docker network, never from
      # loopback, so without this the server refuses every file and git write
      # from the browser. Writes stay confined to registered projects, and the
      # auth token is still required.
      TERMUL_SERVER_ALLOW_REMOTE_WRITES: "true"
      # Sessions and the project registry live under --state-dir in the
      # termul-home volume. Set these only to move one of them elsewhere.
      # TERMUL_SESSIONS_DIR: /home/termul/.local/state/termul/sessions
      # TERMUL_PROJECTS_FILE: /home/termul/.local/state/termul/projects.json
    volumes:
      # Server state, the auth token, and the home directory of the user that
      # runs shells and agents (git config, SSH keys, agent logins).
      - termul-home:/home/termul
      # The only host directory the server can see. Add projects under
      # /workspace in the web UI.
      - type: bind
        source: ${TERMUL_WORKSPACE:-./workspace}
        target: /workspace
        bind:
          create_host_path: false
    # Hardening. If a tool you run in Termul must write outside /home/termul,
    # /workspace, or /tmp, remove read_only. /tmp is mounted exec so tools can
    # run helper binaries from it.
    read_only: true
    tmpfs:
      - /tmp:exec,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

volumes:
  termul-home: