ChainLoop/docker-compose.yaml.example at main · grayum/ChainLoop · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
# Private/internal deployment only. ChainLoop has no authentication or authorization.
# Enforce external access policy (authenticated proxy, VPN, IP allowlist, etc.)
# and prevent access that bypasses it. Do not publish the application port.
# See SECURITY.md before deployment.
services:
  chainloop:
    build: .
    image: chainloop:local
    container_name: chainloop
    restart: unless-stopped
    init: true
    read_only: true
    stop_grace_period: 30s
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=64m,mode=1777

    environment:
      DATABASE_URL: "${DATABASE_URL:-sqlite:////data/chainloop.db}"
      APP_BASE_URL: "${APP_BASE_URL:?Set APP_BASE_URL in .env}"
      CHAINLOOP_ALLOWED_HOSTS: "${CHAINLOOP_ALLOWED_HOSTS:-127.0.0.1,localhost}"
      CHAINLOOP_DEV_ALLOW_OUTBOUND_MOCKS: "false"

      STRAVA_CLIENT_ID: "${STRAVA_CLIENT_ID:?Set STRAVA_CLIENT_ID in .env}"
      STRAVA_CLIENT_SECRET: "${STRAVA_CLIENT_SECRET:?Set STRAVA_CLIENT_SECRET in .env}"
      STRAVA_REDIRECT_URI: "${STRAVA_REDIRECT_URI:?Set STRAVA_REDIRECT_URI in .env}"
      STRAVA_SCOPES: "${STRAVA_SCOPES:-activity:read_all}"
      STRAVA_API_BASE_URL: "${STRAVA_API_BASE_URL:-https://www.strava.com/api/v3}"
      STRAVA_VERIFY_TOKEN: "${STRAVA_VERIFY_TOKEN:-}"
      STRAVA_AUTO_SYNC: "${STRAVA_AUTO_SYNC:-true}"
      STRAVA_SYNC_TIME: "${STRAVA_SYNC_TIME:-21:00}"
      STRAVA_SYNC_TIMES: "${STRAVA_SYNC_TIMES:-}"
      CHAINLOOP_TIMEZONE: "${CHAINLOOP_TIMEZONE:-Europe/Amsterdam}"

      SESSION_SECRET: "${SESSION_SECRET:?Set SESSION_SECRET in .env}"

      PUSHOVER_APP_TOKEN: "${PUSHOVER_APP_TOKEN:?Set PUSHOVER_APP_TOKEN in .env}"
      PUSHOVER_USER_KEY: "${PUSHOVER_USER_KEY:?Set PUSHOVER_USER_KEY in .env}"

    # Attach your operator-managed access-policy middleware here, for example:
    # traefik.http.routers.chainloop.middlewares=your-auth-policy@file
    # TLS labels below do not authenticate callers. Equivalent external VPN/
    # firewall access policy is also supported; verify it before deployment.
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      - "traefik.http.routers.chainloop.rule=Host(`${CHAINLOOP_HOST:?Set CHAINLOOP_HOST in .env}`)"
      - "traefik.http.routers.chainloop.entrypoints=websecure"
      - "traefik.http.routers.chainloop.tls=true"
      - "traefik.http.routers.chainloop.tls.certresolver=myresolver"
      - "traefik.http.services.chainloop.loadbalancer.server.port=8080"

    networks:
      - traefik

    volumes:
      # This exact directory must be writable by ChainLoop UID/GID 10001.
      - ./data:/data:rw

    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

networks:
  traefik:
    external: true