Latte
5d24ec3687
CI / lint (pull_request) Successful in 50s
docker / lint (pull_request) Successful in 53s
CI / test (pull_request) Successful in 1m2s
docker / test (pull_request) Successful in 1m1s
CI / publish (pull_request) Has been skipped
docker / docker (pull_request) Successful in 42s
71 lines
2.7 KiB
YAML
71 lines
2.7 KiB
YAML
services:
|
|
familiar:
|
|
# Pull the image published to Gitea by .gitea/workflows/docker.yml, or build
|
|
# locally with `docker compose build`. Pick the channel via .env:
|
|
# FAMILIAR_IMAGE (:latest / :main for prod, :dev for the dev channel).
|
|
image: ${FAMILIAR_IMAGE:-git.hiddenden.cafe/hiddenden/familiar:latest}
|
|
build:
|
|
context: .
|
|
dockerfile: docker/Dockerfile
|
|
container_name: familiar
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
FAMILIAR_HTTP_HOST: 0.0.0.0
|
|
FAMILIAR_HTTP_PORT: "8080"
|
|
FAMILIAR_HTTP_PATH: ${FAMILIAR_HTTP_PATH:-/mcp}
|
|
FAMILIAR_DATA_DIR: /data
|
|
# bearer (default) or oauth. In bearer mode FAMILIAR_HTTP_TOKEN is required.
|
|
FAMILIAR_AUTH_MODE: ${FAMILIAR_AUTH_MODE:-bearer}
|
|
# Bearer token clients send as `Authorization: Bearer <token>`. REQUIRED in
|
|
# bearer mode — `familiar serve` refuses to start on 0.0.0.0 without it
|
|
# (unless FAMILIAR_ALLOW_INSECURE_BIND=true). Leave blank for oauth mode.
|
|
FAMILIAR_HTTP_TOKEN: ${FAMILIAR_HTTP_TOKEN:-}
|
|
# OAuth 2.1 resource-server settings (only used when AUTH_MODE=oauth).
|
|
FAMILIAR_OAUTH_ISSUER: ${FAMILIAR_OAUTH_ISSUER:-}
|
|
FAMILIAR_OAUTH_RESOURCE: ${FAMILIAR_OAUTH_RESOURCE:-}
|
|
FAMILIAR_OAUTH_AUDIENCE: ${FAMILIAR_OAUTH_AUDIENCE:-}
|
|
FAMILIAR_OAUTH_JWKS_URI: ${FAMILIAR_OAUTH_JWKS_URI:-}
|
|
# Writes are off by default over HTTP; set true in .env to allow them.
|
|
FAMILIAR_ENABLE_WRITES: ${FAMILIAR_ENABLE_WRITES:-false}
|
|
# The encrypted token store (token.enc + key), audit log, and write toggle
|
|
# live under /data. Run `familiar login` (or `login --no-browser`) once, then
|
|
# point this at that data dir (or copy token.enc + key into ./data).
|
|
volumes:
|
|
- ${FAMILIAR_DATA_DIR_HOST:-./data}:/data
|
|
# Not published to the host — only reachable on the internal proxy network,
|
|
# where your TLS reverse proxy terminates HTTPS and forwards to :8080.
|
|
expose:
|
|
- "8080"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
user: "1000:1000"
|
|
# networks:
|
|
# - proxy
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD",
|
|
"python",
|
|
"-c",
|
|
"import httpx; httpx.get('http://127.0.0.1:8080/healthz', timeout=5).raise_for_status()",
|
|
]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
# No proxy labels: Pangolin discovers this service on the shared `proxy`
|
|
# network and forwards to :8080 — configure the route in Pangolin, not here.
|
|
|
|
# networks:
|
|
# # Shared reverse-proxy network (Pangolin). Create once with:
|
|
# # docker network create proxy
|
|
# proxy:
|
|
# external: true
|