57_WolveandClaude Opus 4.8
c00ca055f2
New deployments/copyparty/: copyparty (copyparty/ac) behind Caddy/LE for the web UI/WebDAV, plus its own SFTP (password auth) and FTPS listeners published directly. Ships update.sh, which drives container updates off copyparty's security-advisories API (api.copyparty.eu/advisories) -- policies latest|security|off. - Real client IP end-to-end: Caddy XFF/X-Real-IP + copyparty xff-src: lan. - SFTP host key + self-signed FTPS cert generated/persisted in /cfg; admin password generated on first deploy; conf auto-included via the image's % /cfg. - Firewall opens 80/443 + SFTP/FTPS + passive range (colon form for ports.d). - Wired into automations.sh, README, .gitignore; cloud-init for fresh VMs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
2.2 KiB
Bash
51 lines
2.2 KiB
Bash
# Copy to .env and fill in. docker compose picks .env up automatically.
|
|
|
|
# --- Public hostname (web UI / WebDAV via Caddy) ----------------------------
|
|
# Bare hostname (no scheme) where the copyparty web UI is reached.
|
|
COPYPARTY_DOMAIN=files.example.com
|
|
|
|
# Email for Let's Encrypt registration / expiry notifications.
|
|
ACME_EMAIL=admin@example.com
|
|
|
|
# --- Image -----------------------------------------------------------------
|
|
# `ac` is the recommended edition (Pillow + FFmpeg thumbnails/transcode).
|
|
# Use ghcr.io/9001/copyparty-ac to pull from GitHub instead of Docker Hub.
|
|
COPYPARTY_IMAGE=copyparty/ac
|
|
# Pinned version, e.g. 1.20.11. deploy.sh resolves "latest" to the newest
|
|
# release on first deploy so the running version is always explicit; update.sh
|
|
# bumps this tag when it updates.
|
|
COPYPARTY_TAG=latest
|
|
|
|
# --- Data + identity --------------------------------------------------------
|
|
# Host directory shared as the data root (mounted at /w). Created by deploy.sh
|
|
# and chowned to PUID:PGID. Point this at a big disk / mount for real use.
|
|
DATA_DIR=/srv/copyparty/data
|
|
PUID=1000
|
|
PGID=1000
|
|
|
|
# --- SFTP / FTPS (direct listeners, bypass Caddy) ---------------------------
|
|
# Host interface to publish the direct listeners on (blank = 0.0.0.0 = all).
|
|
# A published Docker port bypasses the host firewall, so pin this to a trusted
|
|
# interface (e.g. a Tailscale IP) on multi-homed boxes.
|
|
BIND_ADDR=
|
|
SFTP_PORT=3922
|
|
FTPS_PORT=3990
|
|
# Passive-FTP TCP port range (hyphen form; published as-is in docker-compose).
|
|
FTP_PASV_RANGE=12000-12099
|
|
# Public IP for passive FTPS through NAT. Leave blank if clients reach the
|
|
# server directly; set it to the server's external IP otherwise.
|
|
FTP_NAT=
|
|
|
|
# --- Updates (scripts: update.sh) -------------------------------------------
|
|
# How the scheduled updater behaves:
|
|
# latest - update to the newest release whenever one exists (default)
|
|
# security - update ONLY when the running version has a known advisory
|
|
# off - never change the running version (check/notify only)
|
|
UPDATE_POLICY=latest
|
|
# Advisory feed used by `security` policy + `update.sh check`:
|
|
# advisories-panic (critical only) | advisories (important) | advisories-all
|
|
VC_FEED=advisories
|
|
|
|
# --- Image tags -------------------------------------------------------------
|
|
CADDY_TAG=2-alpine
|