openRSS/docker-compose.postgres.yml at main · CariSoftwareBR/openRSS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
# openRSS com PostgreSQL embutido — para instâncias com mais usuários.
# DATABASE_URL já vem definida, então o assistente de instalação é pulado.
#   POSTGRES_PASSWORD=$(openssl rand -hex 32) docker compose -f docker-compose.postgres.yml up -d --build
services:
  postgres:
    # Tag flutuante: recebe as correções do PostgreSQL 17 sem mudar de versão principal.
    image: postgres:17-alpine
    pull_policy: always
    restart: unless-stopped
    environment:
      POSTGRES_USER: openrss
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?defina POSTGRES_PASSWORD}
      POSTGRES_DB: openrss
    volumes:
      - openrss-pg:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U openrss -d openrss"]
      interval: 5s
      timeout: 5s
      retries: 10

  openrss:
    build:
      context: .
      # Baixa a imagem base mais recente a cada build (patches de segurança do Node/Debian).
      pull: true
    image: openrss:${OPENRSS_IMAGE_TAG:-local}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "8285:3000"
    environment:
      # Opcional: se vazio, é gerado no primeiro boot e salvo em /data/config.json.
      APP_SECRET: ${APP_SECRET:-}
      BETTER_AUTH_URL: ${BETTER_AUTH_URL:-http://localhost:8285}
      DATABASE_PROVIDER: postgresql
      DATABASE_URL: postgresql://openrss:${POSTGRES_PASSWORD:?defina POSTGRES_PASSWORD}@postgres:5432/openrss
      ALLOW_PRIVATE_FEEDS: ${ALLOW_PRIVATE_FEEDS:-false}
      ALLOW_PRIVATE_WEBHOOKS: ${ALLOW_PRIVATE_WEBHOOKS:-false}
      # Login único (opcional): veja a tabela de variáveis no README.
      OIDC_ISSUER: ${OIDC_ISSUER:-}
      OIDC_DISCOVERY_URL: ${OIDC_DISCOVERY_URL:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
      OIDC_PROVIDER_NAME: ${OIDC_PROVIDER_NAME:-}
      OIDC_SCOPES: ${OIDC_SCOPES:-}
      OIDC_AUTO_REGISTER: ${OIDC_AUTO_REGISTER:-}
      OIDC_DISABLE_PASSWORD_LOGIN: ${OIDC_DISABLE_PASSWORD_LOGIN:-}
      # E-mail (opcional): redefinição de senha e digest por e-mail.
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-}
      SMTP_SECURE: ${SMTP_SECURE:-}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM: ${SMTP_FROM:-}
      DISABLE_SCHEDULER: ${DISABLE_SCHEDULER:-false}
    volumes:
      # Guarda o APP_SECRET gerado (config.json) entre atualizações.
      - openrss-data:/data

volumes:
  openrss-pg:
  openrss-data: