Latte
39ce8005c0
- docker/Dockerfile: multi-stage uv wheel build; runtime runs `familiar serve` as a non-root user (uid 1000) on port 8080, /data volume for the encrypted token store, and a HEALTHCHECK against /healthz. No token is baked in — serve refuses to start without FAMILIAR_HTTP_TOKEN, so it's supplied at run time. - docker-compose.yml: joins an external `proxy` network (Traefik labels for TLS, nginx/Caddy documented as alternatives), read-only rootfs, tmpfs /tmp, no-new-privileges, cap_drop ALL, non-root, /healthz healthcheck. Pulls the published FAMILIAR_IMAGE with a local build as fallback; writes default off. - .env.example: every FAMILIAR_* knob incl. the bearer token, auth mode, the OAuth resource-server settings, and the insecure-bind escape hatch. - .dockerignore: keep local state (data/, *.enc, key) and dev files out.
27 lines
381 B
Plaintext
27 lines
381 B
Plaintext
# Keep the build context small and never ship local state or secrets.
|
|
.git
|
|
.gitea
|
|
.venv
|
|
**/__pycache__/
|
|
*.pyc
|
|
.pytest_cache
|
|
.ruff_cache
|
|
.coverage
|
|
htmlcov
|
|
dist
|
|
build
|
|
*.egg-info
|
|
|
|
# Local EVE token store / data dir — must never end up in an image layer.
|
|
data
|
|
*.enc
|
|
key
|
|
|
|
# Docs, tests, and dev tooling aren't needed at runtime.
|
|
tests
|
|
doc
|
|
docker-compose.yml
|
|
.env
|
|
.env.*
|
|
!.env.example
|