Gan, Jimmy
ddaf3c6cee
- Add JWT token auth to OPC WebSocket (unauthenticated → 403, per-user tracking) - Externalize Transmission RPC credentials to TRANSMISSION_USER/PASS env vars - Remove hardcoded SECRET_KEY fallback from dev compose - Rate-limit passkey register options endpoint at 5/minute - Add PDD (docs/improvement-plan.md) and sprint specs (specs/) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
92 lines
2.9 KiB
YAML
92 lines
2.9 KiB
YAML
services:
|
|
docker-socket-proxy:
|
|
image: tecnativa/docker-socket-proxy
|
|
container_name: docker-socket-proxy
|
|
restart: unless-stopped
|
|
labels:
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
environment:
|
|
CONTAINERS: 1
|
|
IMAGES: 1
|
|
INFO: 1
|
|
POST: 1
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
networks:
|
|
- internal
|
|
- nas-dashboard_internal
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
dashboard:
|
|
# build: .
|
|
image: nas-dashboard:latest
|
|
container_name: nas-dashboard
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:4000:4000"
|
|
environment:
|
|
- DOCKER_HOST=tcp://docker-socket-proxy:2375
|
|
- GITEA_URL=http://gitea:3000
|
|
- GITEA_TOKEN=${GITEA_TOKEN}
|
|
- VOLUME_ROOT=/volume1
|
|
- SSH_HOST=host.docker.internal
|
|
- SSH_USER=zjgump
|
|
- VPS_SSH_HOST=158.101.140.85
|
|
- VPS_SSH_USER=jimmyg
|
|
- CADDY_VPS_SSH_HOST=161.33.182.109
|
|
- CADDY_VPS_SSH_USER=ubuntu
|
|
- MAC_SSH_HOST=192.168.31.22
|
|
- MAC_SSH_USER=jimmyg
|
|
- SECRET_KEY=${SECRET_KEY}
|
|
- ADMIN_USER=jimmy
|
|
- ADMIN_PASSWORD_HASH=${ADMIN_PASSWORD_HASH}
|
|
- TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
|
|
- TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID:-}
|
|
- TELEGRAM_PROXY=${TELEGRAM_PROXY:-}
|
|
- CORS_ORIGINS=https://nas.jimmygan.com
|
|
- WEBAUTHN_RP_ID=jimmygan.com
|
|
- WEBAUTHN_ORIGINS=https://nas.jimmygan.com,https://nas.jimmygan.com:8443,https://auth.jimmygan.com:8443
|
|
- LITELLM_HEALTH_API_KEY=${LITELLM_HEALTH_API_KEY:-}
|
|
- LITELLM_URL=http://litellm:4005
|
|
- GITEA_DB_PASSWORD=${GITEA_DB_PASSWORD}
|
|
- TRANSMISSION_USER=${TRANSMISSION_USER}
|
|
- TRANSMISSION_PASS=${TRANSMISSION_PASS}
|
|
volumes:
|
|
- /volume1:/volume1
|
|
- /volume1/docker/nas-dashboard/ssh/dashboard_terminal:/app/ssh/id_ed25519:ro
|
|
- /volume1/docker/nas-dashboard/ssh/vps_terminal:/app/ssh/vps_id_ed25519:ro
|
|
- /volume1/docker/nas-dashboard/ssh/mac_terminal:/app/ssh/mac_id_ed25519:ro
|
|
- /volume1/docker/nas-dashboard/ssh/known_hosts:/app/ssh/known_hosts:ro
|
|
- /volume1/docker/chat-summarizer/data:/app/data/chat-summarizer:ro
|
|
- /volume1/docker/info-engine/data:/app/data/info-engine:ro
|
|
- /volume1/docker/nas-dashboard/rbac.json:/volume1/docker/nas-dashboard/rbac.json
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/api/health')"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
networks:
|
|
- internal
|
|
- gitea_gitea
|
|
- nas-dashboard_internal
|
|
depends_on:
|
|
- docker-socket-proxy
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
networks:
|
|
internal:
|
|
gitea_gitea:
|
|
external: true
|
|
nas-dashboard_internal:
|
|
external: true
|