Publish ITWorx Pulse source

deploy/compose.prod.yaml

@@ -0,0 +1,65 @@
+# Production overlay for the ITWorx Pulse deployment on the Unraid host.
+#
+# Usage:
+#   docker compose -f deploy/compose.yaml -f deploy/compose.prod.yaml up -d
+#
+# The base compose file deliberately publishes no host port: ADR-0010 requires a
+# controlled proxy edge and forbids guessing a host port. The port is no longer a
+# guess — 1238 was chosen by the operator for this host (ADR-0011) — so it is
+# recorded here, in a separate overlay, rather than being baked into the base file
+# that other environments share.
+#
+# Only pulse-web is published. pulse-api stays on the internal-only network and is
+# reached exclusively through nginx inside pulse-web, so the API cannot be addressed
+# directly from the LAN even by accident.
+#
+# The bind address is configurable and defaults to all interfaces, because Nginx
+# Proxy Manager runs in its own container and cannot reach a 127.0.0.1 binding on the
+# host. If NPM is configured to reach Pulse over a shared Docker network instead, set
+# PULSE_PUBLISH_ADDRESS=127.0.0.1 to remove the LAN exposure entirely.
+services:
+  pulse-web:
+    ports:
+      - "${PULSE_PUBLISH_ADDRESS:-0.0.0.0}:${PULSE_HOST_PORT:-1238}:8080"
+
+  pulse-api:
+    environment:
+      PULSE_ENV: production
+      # Must match the externally reachable URL that terminates TLS, not the
+      # host:port published above, because the OIDC redirect and every absolute
+      # link the API emits have to be valid from the browser's point of view.
+      PULSE_PUBLIC_URL: ${PULSE_PUBLIC_URL:?PULSE_PUBLIC_URL must be set to the externally reachable HTTPS URL}
+      # Fail Compose resolution before touching the running stack if no
+      # identity claim can be mapped onto a bounded Pulse role.
+      PULSE_OIDC_ROLE_MAPPING: ${PULSE_OIDC_ROLE_MAPPING:?PULSE_OIDC_ROLE_MAPPING must contain at least one claim=role entry}
+      PULSE_OIDC_GROUPS_CLAIM: ${PULSE_OIDC_GROUPS_CLAIM:-groups}
+      # The host path is interpolated into the bind mount below; inside the
+      # container the manager always receives this fixed, non-secret path.
+      PULSE_BACKUP_DIR: /var/lib/pulse/backups
+      PULSE_BACKUP_RETENTION: ${PULSE_BACKUP_RETENTION:-5}
+    volumes:
+      - type: bind
+        source: ${PULSE_BACKUP_DIR:?PULSE_BACKUP_DIR must be an operator-owned host directory outside the database volume}
+        target: /var/lib/pulse/backups
+
+  pulse-worker:
+    environment:
+      PULSE_ENV: production
+
+  pulse-agent:
+    environment:
+      PULSE_ENV: production
+      # The kernel reports the container's own name through the UTS namespace, so
+      # the real host name has to be supplied explicitly.
+      PULSE_AGENT_HOST_NAME: ${PULSE_AGENT_HOST_NAME:?PULSE_AGENT_HOST_NAME must be set to the Unraid host name}
+      PULSE_UNRAID_CA_FILE: /run/pulse/unraid-ca.pem
+    volumes:
+      - type: bind
+        source: ${PULSE_UNRAID_CA_FILE_HOST:?PULSE_UNRAID_CA_FILE_HOST must point to the public Unraid TLS certificate}
+        target: /run/pulse/unraid-ca.pem
+        read_only: true
+    # Resolve the certificate hostname from PULSE_UNRAID_URL to the explicitly
+    # discovered reachable Unraid host address. This avoids host networking and
+    # keeps normal certificate hostname verification active.
+    extra_hosts:
+      - "${PULSE_UNRAID_HOST_NAME:?PULSE_UNRAID_HOST_NAME must match the hostname in PULSE_UNRAID_URL}:${PULSE_UNRAID_HOST_GATEWAY:?PULSE_UNRAID_HOST_GATEWAY must be the reachable address of this Unraid host}"