0e54b86dac
- docker-compose: CODER_OIDC_* wired to Authelia (password login kept as break-glass) - scripts/backup-stacks.sh + stacks-backup.timer: nightly pg_dump, Continue state, stack configs - vault: verification items 13/14, auth-model OIDC section, limits DNS-01 runbook
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
services:
|
|
database:
|
|
image: postgres:17
|
|
container_name: coder-database
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: coder
|
|
POSTGRES_PASSWORD: ${CODER_PG_PASSWORD}
|
|
POSTGRES_DB: coder
|
|
volumes:
|
|
- coder_pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U coder -d coder"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 12
|
|
mem_limit: 2g
|
|
|
|
coder:
|
|
image: ghcr.io/coder/coder:v2.35.3
|
|
container_name: coder
|
|
restart: unless-stopped
|
|
depends_on:
|
|
database:
|
|
condition: service_healthy
|
|
ports:
|
|
- "127.0.0.1:52226:7080"
|
|
environment:
|
|
CODER_HTTP_ADDRESS: 0.0.0.0:7080
|
|
CODER_ACCESS_URL: https://code.loca.zone
|
|
CODER_PG_CONNECTION_URL: postgresql://coder:${CODER_PG_PASSWORD}@database:5432/coder?sslmode=disable
|
|
CODER_TELEMETRY_ENABLE: "false"
|
|
# Authelia OIDC. Password login stays enabled as break-glass, so
|
|
# CODER_DISABLE_PASSWORD_AUTH is deliberately unset. No email-domain
|
|
# restriction: the Authelia user database is the gate.
|
|
CODER_OIDC_ISSUER_URL: https://auth.loca.zone
|
|
CODER_OIDC_CLIENT_ID: coder
|
|
CODER_OIDC_CLIENT_SECRET: ${CODER_OIDC_CLIENT_SECRET}
|
|
CODER_OIDC_SCOPES: openid,profile,email
|
|
CODER_OIDC_SIGN_IN_TEXT: "Sign in with loca.zone SSO"
|
|
# No CODER_WILDCARD_ACCESS_URL. Nested names such as foo.code.loca.zone
|
|
# DO resolve via the *.loca.zone wildcard; the actual blocker is TLS
|
|
# issuance: this lineage covers only code.loca.zone and
|
|
# wiki.code.loca.zone, and a *.code.loca.zone certificate needs DNS-01
|
|
# validation with DNS-provider credentials that are not configured here.
|
|
# Path-based workspace apps and `coder port-forward` are used instead.
|
|
group_add:
|
|
# host gid of /var/run/docker.sock; required so the built-in provisioner
|
|
# can build docker-template workspaces.
|
|
- "105"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- coder_home:/home/coder
|
|
mem_limit: 8g
|
|
|
|
volumes:
|
|
coder_pgdata:
|
|
coder_home:
|