npanel/compose.yaml at main · soapbox-pub/npanel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
# npanel and a reverse proxy, which is the whole of a production install.
#
#   echo 'DASHBOARD_HOST=panel.example.com' > .env
#   docker compose up -d
#   docker compose exec npanel npanel make-admin npub1yourkeyhere
#
# Caddy gets a certificate for every hostname staff add, asking npanel first
# whether that hostname is configured. See docs/deployment.md.

name: npanel

services:
  npanel:
    build: .
    image: npanel
    restart: unless-stopped
    # Deliberately no `ports`: every listener exists for the proxy alone. npanel
    # speaks plain HTTP, and 3001 authorizes certificates without asking who
    # wants to know.
    expose:
      - "3000"
      - "3001"
    configs:
      - source: npanel
        target: /etc/npanel/npanel.toml
    # Both listeners, since either one being down is a broken gateway.
    # /api/instance is unauthenticated but served only on the dashboard
    # hostname, hence the Host header, and answering it means the database
    # opened; the second call proves Caddy can still get certificates
    # authorized. The dashboard hostname is never metered, so this spends no
    # part of the issuance budget.
    healthcheck:
      test:
        - CMD-SHELL
        - >-
          wget -q -O /dev/null --header "host: ${DASHBOARD_HOST}" http://127.0.0.1:3000/api/instance &&
          wget -q -O /dev/null "http://127.0.0.1:3001/tls-check?domain=${DASHBOARD_HOST}"
      interval: 30s
      timeout: 5s
      start_period: 10s
      retries: 3
    volumes:
      # The database and the blob store, and Tor's state when it is on. This
      # is the volume to back up.
      - npanel-data:/data

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    depends_on:
      # Caddy asks npanel before issuing any certificate, and proxies to it.
      # Waiting avoids serving 502s and denying certificates during startup.
      npanel:
        condition: service_healthy
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp" # HTTP/3
    environment:
      DASHBOARD_HOST: ${DASHBOARD_HOST:?set DASHBOARD_HOST in .env, eg panel.example.com}
      # The sample Caddyfile defaults to loopback, for a proxy installed on the
      # host. Here npanel is a container on this network, and its certificate
      # authorization answers on a second port.
      NPANEL_UPSTREAM: npanel:3000
      NPANEL_TLS_CHECK: npanel:3001
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      # Certificates and ACME account keys. Losing this means re-issuing every
      # certificate, which Let's Encrypt rate limits.
      - caddy-data:/data
      - caddy-config:/config

# npanel's configuration file. bind_address is every address so that Caddy, in
# another container, can reach it: safe only because nothing publishes these
# ports, since npanel speaks plain HTTP and 3001 authorizes certificates for
# anyone who asks. To set anything else npanel.example.toml lists, add it here.
configs:
  npanel:
    content: |
      # The public hostname of the dashboard. It decides which requests are
      # the dashboard rather than an nsite, and NIP-98 logins are checked
      # against it.
      dashboard_host = "${DASHBOARD_HOST:?set DASHBOARD_HOST in .env, eg panel.example.com}"
      log_level = "${LOG_LEVEL:-info}"
      bind_address = "0.0.0.0"
      port = 3000
      tls_check_port = 3001
      data_dir = "/data"

volumes:
  npanel-data:
  caddy-data:
  caddy-config: