Lumen
64 lines
3.3 KiB
YAML
64 lines
3.3 KiB
YAML
# TrueNAS homelab override — applied on top of docker-compose.yml for the
|
|
# homelab deployment on TrueNAS.local. Proven on InspectFlow + CannaManage.
|
|
#
|
|
# Replace placeholders before first push:
|
|
# __PROJECT__ container prefix / compose project name
|
|
# __FRONTEND_PORT__ unique LAN host port for the frontend (registry §2)
|
|
# __BACKEND_PORT__ unique LAN host port for backend debug (or remove block)
|
|
# __SUBDOMAIN__ public hostname (only matters once you go public)
|
|
#
|
|
# Topology (public phase — additive, see runbook §4):
|
|
# browser ──HTTPS──> IONOS Apache (82.165.206.45, TLS via acme.sh/LE)
|
|
# ──ProxyPass──> VPS frps (85.214.154.199:<frpRemotePort>)
|
|
# ──frp tunnel──> TrueNAS frpc ──> frontend:__FRONTEND_PORT__ (this stack)
|
|
# frontend proxies /api/backend/* to backend:8080 via the server-side Route
|
|
# Handler (src/app/api/backend/[...path]/route.ts), so only the frontend port
|
|
# needs to be tunnelled — no separate API exposure.
|
|
#
|
|
# Usage (run by the Gitea act_runner on push to main):
|
|
# docker compose -f docker-compose.yml -f docker-compose.truenas.yml \
|
|
# -p __PROJECT__ up -d --build --remove-orphans
|
|
services:
|
|
db:
|
|
# Internal-only: drop any host :5432 publish inherited from docker-compose.yml.
|
|
# Postgres must NOT be exposed to the LAN. The backend reaches it over the
|
|
# compose network (db:5432) and the deploy's ALTER USER reconcile uses
|
|
# `docker exec`, so no published host port is needed. (!override [] replaces
|
|
# the inherited ports list — compose otherwise concatenates lists.)
|
|
ports: !override []
|
|
# POSTGRES_PASSWORD only takes effect on FIRST volume init; an existing
|
|
# volume keeps its current role password (the deploy reconciles it via
|
|
# ALTER USER). This value seeds a fresh volume with the prod password.
|
|
environment:
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD:-__PROJECT___dev}
|
|
|
|
backend:
|
|
# Remap host port to a unique value (8080 is taken by other stacks on TrueNAS).
|
|
# !override replaces the inherited ports list. Internal container port stays
|
|
# 8080 so frontend's BACKEND_URL=http://backend:8080 is unaffected.
|
|
# Remove this whole ports block if you don't need LAN debug access.
|
|
ports: !override
|
|
- "__BACKEND_PORT__:8080"
|
|
environment:
|
|
# Real production password (must match the live DB role; see ALTER USER).
|
|
SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD:-__PROJECT___dev}
|
|
# Rotated production JWT signing key (base64 — JwtService base64-decodes it).
|
|
# Rotating this invalidates all previously issued access/refresh tokens.
|
|
__PROJECT___SECURITY_JWT_SECRET: ${JWT_SECRET}
|
|
|
|
frontend:
|
|
ports: !override
|
|
- "__FRONTEND_PORT__:3000"
|
|
environment:
|
|
# Public origin so NextAuth callbacks/cookies resolve to the HTTPS host.
|
|
# For LOCAL-ONLY phase you can set these to http://192.168.188.119:__FRONTEND_PORT__
|
|
NEXTAUTH_URL: https://__SUBDOMAIN__
|
|
AUTH_URL: https://__SUBDOMAIN__
|
|
# NextAuth v5 (Auth.js) reads AUTH_SECRET. Rotating it invalidates sessions.
|
|
AUTH_SECRET: ${AUTH_SECRET}
|
|
# Trust the X-Forwarded-* headers from the Apache/frp chain (TLS terminates
|
|
# upstream; plain HTTP is proxied into the container).
|
|
AUTH_TRUST_HOST: "true"
|
|
# Server-side proxy target for /api/backend/* (internal compose DNS).
|
|
BACKEND_URL: http://backend:8080
|