mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-04 00:47:01 +01:00
nvrl
cc7d05aaf2
WORKSPACE_SESSION_KEY_FILE names a file holding a 32-byte key, meant to be a Docker secret. When it is set, proton-session.json is written as AES-256-GCM ciphertext, so a copy of the data volume alone no longer carries a usable session. That is what the OS keyring gives a native host, for a container that has no Secret Service. A plain session found while a key is set is sealed the first time it is read. A sealed file without its key, or a malformed key file, is an error at startup rather than a quiet fall back to plain JSON.
49 lines
1.7 KiB
Plaintext
49 lines
1.7 KiB
Plaintext
# Copy to compose.override.yml on the host that runs traefik.
|
|
services:
|
|
workspace:
|
|
# Traefik only routes HTTP; SFTP (raw TCP) can't go through it, so its
|
|
# port is published straight to the host instead. Restrict to your IP,
|
|
# or leave it 127.0.0.1 and reach it over a VPN/SSH tunnel.
|
|
# Requires WORKSPACE_SFTP_BIND=0.0.0.0:2222 in .env to actually listen.
|
|
ports: !override
|
|
- "127.0.0.1:2222:2222"
|
|
networks:
|
|
- narl
|
|
- internal_net
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=narl"
|
|
- "traefik.http.routers.workspace.rule=Host(`workspace.narl.io`)"
|
|
- "traefik.http.routers.workspace.entrypoints=websecure"
|
|
- "traefik.http.routers.workspace.tls.certresolver=https_resolver"
|
|
- "traefik.http.services.workspace.loadbalancer.server.port=4242"
|
|
# The key the Proton session is sealed under, mounted from the host at
|
|
# /run/secrets/session_key. Needs WORKSPACE_SESSION_KEY_FILE in .env.
|
|
secrets:
|
|
- session_key
|
|
|
|
# Mail, locally. Mailpit accepts everything on 1025 and shows it on 8025, so
|
|
# the reminders can be read before a real relay is ever involved:
|
|
#
|
|
# WORKSPACE_SMTP_URL=smtp://mailpit:1025
|
|
# WORKSPACE_MAIL_TO=you@example.org
|
|
#
|
|
# Nothing it receives leaves the host, which is the point of testing here.
|
|
mailpit:
|
|
image: axllent/mailpit:latest
|
|
restart: unless-stopped
|
|
networks:
|
|
- internal_net
|
|
ports:
|
|
- "127.0.0.1:8025:8025"
|
|
|
|
secrets:
|
|
# Outside compose is a plain bind mount, so the file must be readable by
|
|
# the container's user: `chown 10001 secrets/session.key`.
|
|
session_key:
|
|
file: ./secrets/session.key
|
|
|
|
networks:
|
|
narl:
|
|
external: true
|