jcoffey-dev
bb25355c23
Every build writes the exact source it was built from, uncommitted work and new files included, as source.tar.gz next to the app, named after that tree. Docker builds, which have no git, pack the build context and name it by a hash of its files. The sign-in page and Settings > About link to it instead of a repository that can drift. What users, operators and packagers see no longer names the upstream server: - interface text, in all nine catalogues, with a token-session line for Security; - server messages; - the settings, now MAIL_SERVER_URL, MAIL_SERVERS_FILE, ADMIN_URL and MAIL_SERVER_FOLLOW_ADVERTISED_URLS, and mail-servers.example.json; - the Tenants notice, which is gone; - the README, CONTRIBUTING and SECURITY. ihasmail's own FEATURES, KNOWN-ISSUES and ROADMAP stay with public ihasmail, and INBUXA.md is folded into the README.
39 lines
1.4 KiB
YAML
39 lines
1.4 KiB
YAML
services:
|
|
ihasmail:
|
|
build:
|
|
context: .
|
|
args:
|
|
# Passed to the build as well as the run because the web bundle writes
|
|
# its own asset URLs: a build that does not know the prefix produces an
|
|
# app that cannot load itself under one. Empty is the domain root.
|
|
BASE_PATH: ${BASE_PATH:-}
|
|
image: ihasmail:2
|
|
restart: unless-stopped
|
|
# Loopback only: ihasmail expects a TLS reverse proxy in front of it. On
|
|
# every interface the app is reachable over plain HTTP, passwords and all,
|
|
# and with TRUST_PROXY any machine on a private network can set its own
|
|
# X-Forwarded-For. A proxy running in Docker can reach the service by name
|
|
# on the compose network and needs no published port at all.
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
# The app needs no privileges and writes only to /data and /tmp.
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
environment:
|
|
MAIL_SERVER_URL: ${MAIL_SERVER_URL:?set MAIL_SERVER_URL in .env}
|
|
APP_SECRET: ${APP_SECRET:?set APP_SECRET in .env (openssl rand -base64 48)}
|
|
APP_NAME: ${APP_NAME:-ihasmail}
|
|
BASE_PATH: ${BASE_PATH:-}
|
|
SOURCE_URL: ${SOURCE_URL:-https://github.com/Coffey-Labs/ihasmail}
|
|
TRUST_PROXY: "1"
|
|
IMAGE_PROXY: "1"
|
|
volumes:
|
|
- ihasmail-data:/data
|
|
volumes:
|
|
ihasmail-data:
|