ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
66 lines
3.4 KiB
YAML
66 lines
3.4 KiB
YAML
# Production overlay for the ITWorx Pulse deployment on the Unraid host.
|
|
#
|
|
# Usage:
|
|
# docker compose -f deploy/compose.yaml -f deploy/compose.prod.yaml up -d
|
|
#
|
|
# The base compose file deliberately publishes no host port: ADR-0010 requires a
|
|
# controlled proxy edge and forbids guessing a host port. The port is no longer a
|
|
# guess — 1238 was chosen by the operator for this host (ADR-0011) — so it is
|
|
# recorded here, in a separate overlay, rather than being baked into the base file
|
|
# that other environments share.
|
|
#
|
|
# Only pulse-web is published. pulse-api stays on the internal-only network and is
|
|
# reached exclusively through nginx inside pulse-web, so the API cannot be addressed
|
|
# directly from the LAN even by accident.
|
|
#
|
|
# The bind address is configurable and defaults to all interfaces, because Nginx
|
|
# Proxy Manager runs in its own container and cannot reach a 127.0.0.1 binding on the
|
|
# host. If NPM is configured to reach Pulse over a shared Docker network instead, set
|
|
# PULSE_PUBLISH_ADDRESS=127.0.0.1 to remove the LAN exposure entirely.
|
|
services:
|
|
pulse-web:
|
|
ports:
|
|
- "${PULSE_PUBLISH_ADDRESS:-0.0.0.0}:${PULSE_HOST_PORT:-1238}:8080"
|
|
|
|
pulse-api:
|
|
environment:
|
|
PULSE_ENV: production
|
|
# Must match the externally reachable URL that terminates TLS, not the
|
|
# host:port published above, because the OIDC redirect and every absolute
|
|
# link the API emits have to be valid from the browser's point of view.
|
|
PULSE_PUBLIC_URL: ${PULSE_PUBLIC_URL:?PULSE_PUBLIC_URL must be set to the externally reachable HTTPS URL}
|
|
# Fail Compose resolution before touching the running stack if no
|
|
# identity claim can be mapped onto a bounded Pulse role.
|
|
PULSE_OIDC_ROLE_MAPPING: ${PULSE_OIDC_ROLE_MAPPING:?PULSE_OIDC_ROLE_MAPPING must contain at least one claim=role entry}
|
|
PULSE_OIDC_GROUPS_CLAIM: ${PULSE_OIDC_GROUPS_CLAIM:-groups}
|
|
# The host path is interpolated into the bind mount below; inside the
|
|
# container the manager always receives this fixed, non-secret path.
|
|
PULSE_BACKUP_DIR: /var/lib/pulse/backups
|
|
PULSE_BACKUP_RETENTION: ${PULSE_BACKUP_RETENTION:-5}
|
|
volumes:
|
|
- type: bind
|
|
source: ${PULSE_BACKUP_DIR:?PULSE_BACKUP_DIR must be an operator-owned host directory outside the database volume}
|
|
target: /var/lib/pulse/backups
|
|
|
|
pulse-worker:
|
|
environment:
|
|
PULSE_ENV: production
|
|
|
|
pulse-agent:
|
|
environment:
|
|
PULSE_ENV: production
|
|
# The kernel reports the container's own name through the UTS namespace, so
|
|
# the real host name has to be supplied explicitly.
|
|
PULSE_AGENT_HOST_NAME: ${PULSE_AGENT_HOST_NAME:?PULSE_AGENT_HOST_NAME must be set to the Unraid host name}
|
|
PULSE_UNRAID_CA_FILE: /run/pulse/unraid-ca.pem
|
|
volumes:
|
|
- type: bind
|
|
source: ${PULSE_UNRAID_CA_FILE_HOST:?PULSE_UNRAID_CA_FILE_HOST must point to the public Unraid TLS certificate}
|
|
target: /run/pulse/unraid-ca.pem
|
|
read_only: true
|
|
# Resolve the certificate hostname from PULSE_UNRAID_URL to the explicitly
|
|
# discovered reachable Unraid host address. This avoids host networking and
|
|
# keeps normal certificate hostname verification active.
|
|
extra_hosts:
|
|
- "${PULSE_UNRAID_HOST_NAME:?PULSE_UNRAID_HOST_NAME must match the hostname in PULSE_UNRAID_URL}:${PULSE_UNRAID_HOST_GATEWAY:?PULSE_UNRAID_HOST_GATEWAY must be the reachable address of this Unraid host}"
|