Latte
39ce8005c0
- docker/Dockerfile: multi-stage uv wheel build; runtime runs `familiar serve` as a non-root user (uid 1000) on port 8080, /data volume for the encrypted token store, and a HEALTHCHECK against /healthz. No token is baked in — serve refuses to start without FAMILIAR_HTTP_TOKEN, so it's supplied at run time. - docker-compose.yml: joins an external `proxy` network (Traefik labels for TLS, nginx/Caddy documented as alternatives), read-only rootfs, tmpfs /tmp, no-new-privileges, cap_drop ALL, non-root, /healthz healthcheck. Pulls the published FAMILIAR_IMAGE with a local build as fallback; writes default off. - .env.example: every FAMILIAR_* knob incl. the bearer token, auth mode, the OAuth resource-server settings, and the insecure-bind escape hatch. - .dockerignore: keep local state (data/, *.enc, key) and dev files out.
47 lines
2.3 KiB
Bash
47 lines
2.3 KiB
Bash
# familiar — remote HTTP / Docker deployment settings.
|
|
# Copy to .env and fill in. .env is gitignored; never commit real secrets.
|
|
|
|
# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
|
|
# Prod channel: :latest or :main. Dev channel: :dev. Or pin :sha-<12>.
|
|
FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest
|
|
|
|
# --- Bind + path ----------------------------------------------------------- #
|
|
# The image binds 0.0.0.0:8080 internally; only the reverse proxy reaches it.
|
|
# FAMILIAR_HTTP_PATH must match your proxy's location block.
|
|
FAMILIAR_HTTP_PATH=/mcp
|
|
|
|
# --- Auth mode ------------------------------------------------------------- #
|
|
# bearer (default) — a single static token (below). Works with every client.
|
|
# oauth — validate external-issuer JWTs; needed only for the Claude web
|
|
# connector (requires an external IdP with DCR). See doc/clients/claude-web.md.
|
|
FAMILIAR_AUTH_MODE=bearer
|
|
|
|
# --- Bearer auth (REQUIRED when FAMILIAR_AUTH_MODE=bearer) ------------------ #
|
|
# Token clients send as `Authorization: Bearer <token>`. Generate a strong one:
|
|
# openssl rand -hex 32
|
|
FAMILIAR_HTTP_TOKEN=
|
|
|
|
# Escape hatch: allow a public (0.0.0.0) bind with NO token. Leave false unless
|
|
# authentication is handled entirely upstream.
|
|
# FAMILIAR_ALLOW_INSECURE_BIND=false
|
|
|
|
# --- OAuth 2.1 resource server (only when FAMILIAR_AUTH_MODE=oauth) --------- #
|
|
# FAMILIAR_OAUTH_ISSUER=https://idp.example.com/application/o/familiar/
|
|
# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com # this server's public URL
|
|
# FAMILIAR_OAUTH_AUDIENCE=https://familiar.example.com # defaults to RESOURCE
|
|
# FAMILIAR_OAUTH_JWKS_URI= # optional; else discovered from issuer
|
|
|
|
# --- Data / writes --------------------------------------------------------- #
|
|
# Host path holding the encrypted token store (token.enc + key), audit log, and
|
|
# write toggle. Produced by `familiar login` on a machine with a browser (or
|
|
# `familiar login --no-browser` on the host).
|
|
FAMILIAR_DATA_DIR_HOST=./data
|
|
|
|
# Writes off by default on a public instance. Set true to allow guarded writes.
|
|
FAMILIAR_ENABLE_WRITES=false
|
|
|
|
# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
|
|
# Only used if you run Traefik. For nginx/Caddy, see doc/deployment.md.
|
|
FAMILIAR_DOMAIN=familiar.example.com
|
|
TRAEFIK_CERTRESOLVER=letsencrypt
|