randy
e13d1a1e97
Upload/delete/move/create-folder now require logging in via Gitea OAuth2 (only MAPTOOL_ALLOWED_GITEA_USER is granted write access); reading stays public. Deploy secrets (session secret, OAuth2 client credentials, allowed user) are written to .env from Gitea Actions repo secrets on every deploy instead of living on the server by hand. Also switch the container's bind address to "[::]" (dual-stack) so the app is reachable over IPv6, not just IPv4.
26 lines
1.3 KiB
YAML
26 lines
1.3 KiB
YAML
services:
|
|
maptool:
|
|
build: .
|
|
restart: unless-stopped
|
|
ports:
|
|
- "4567:4567"
|
|
environment:
|
|
# "[::]", not "0.0.0.0": binding the IPv6 wildcard also accepts IPv4
|
|
# connections (dual-stack is the Linux default), so this covers both
|
|
# without a second listener. Puma's bind URL needs the brackets around
|
|
# a literal IPv6 address (config/puma.rb interpolates this as-is).
|
|
BIND_HOST: "[::]"
|
|
RACK_ENV: production
|
|
# Read from .env (docker compose loads it automatically) — not
|
|
# committed, see docs/deployment.adoc.
|
|
SESSION_SECRET: ${SESSION_SECRET:?SESSION_SECRET is required, see docs/deployment.adoc}
|
|
GITEA_OAUTH_CLIENT_ID: ${GITEA_OAUTH_CLIENT_ID:?GITEA_OAUTH_CLIENT_ID is required, see docs/deployment.adoc}
|
|
GITEA_OAUTH_CLIENT_SECRET: ${GITEA_OAUTH_CLIENT_SECRET:?GITEA_OAUTH_CLIENT_SECRET is required, see docs/deployment.adoc}
|
|
MAPTOOL_ALLOWED_GITEA_USER: ${MAPTOOL_ALLOWED_GITEA_USER:?MAPTOOL_ALLOWED_GITEA_USER is required, see docs/deployment.adoc}
|
|
volumes:
|
|
# Uploaded GPX files and the offline PMTiles extract — kept outside
|
|
# the image so a rebuild/redeploy doesn't wipe them (see
|
|
# docs/development.adoc for how the deploy job treats this
|
|
# directory).
|
|
- ./data:/app/data
|