57_Wolve
8fbeb8f6b0
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates: AUTO_REBOOT=idle reboots only when no SSH active; opt-in Alpine stable-branch upgrades (ALLOW_RELEASE_UPGRADE) - cloud-init: generic base/jumphost + per-deployment, which harden SSH by default on fresh VMs - pocket-id: optional WebFinger block (BASE_DOMAIN), tag v2.8.0 - headscale: fix oidc.expiry schema for 0.28 so the container starts - Gitea release workflow on tag (TOKEN_GITEA); repo URLs -> Gitea - README/LICENSE/.gitignore/.gitattributes (force LF)
56 lines
2.8 KiB
Bash
56 lines
2.8 KiB
Bash
# Copy to .env and fill in. docker compose picks .env up automatically.
|
|
# Never commit the populated .env.
|
|
|
|
# ─── Public hostname ────────────────────────────────────────────────────────
|
|
# Bare hostname (no scheme) of the pocket-id deployment. Used by Caddy for
|
|
# TLS issuance, by anubis as the cookie domain, and to derive APP_URL.
|
|
POCKETID_DOMAIN=
|
|
|
|
# Email for Let's Encrypt registration / expiry notifications.
|
|
ACME_EMAIL=
|
|
|
|
# ─── Pocket-ID ──────────────────────────────────────────────────────────────
|
|
# APP_URL is set automatically from POCKETID_DOMAIN in compose; no need to
|
|
# set it here unless you run pocket-id standalone.
|
|
|
|
# Encryption key. Generate once with: openssl rand -base64 32
|
|
# Rotating this re-encrypts data on next start; losing it is unrecoverable.
|
|
ENCRYPTION_KEY=
|
|
|
|
# Behind Caddy, this MUST be true so pocket-id reads the real client IP and
|
|
# scheme from X-Forwarded-* headers. Leave it -- compose overrides anyway.
|
|
TRUST_PROXY=true
|
|
|
|
# Optional: GeoLite2 license key for IP geolocation in the audit log.
|
|
# Get one free at https://www.maxmind.com/en/geolite2/signup
|
|
MAXMIND_LICENSE_KEY=
|
|
|
|
# UID/GID the pocket-id process runs as inside the container. Match the
|
|
# owner of ./data on the host if you bind-mount instead of using the named
|
|
# volume.
|
|
PUID=1000
|
|
PGID=1000
|
|
|
|
# ─── Anubis ─────────────────────────────────────────────────────────────────
|
|
# Ed25519 private key (hex) for the anubis PoW sidecar. Generate with:
|
|
# openssl rand -hex 32
|
|
# Only needed while the anubis-pid service is enabled in compose.
|
|
ANUBIS_PID_KEY=
|
|
|
|
# ─── WebFinger (optional) ───────────────────────────────────────────────────
|
|
# Leave BOTH blank unless the base domain has no other web server and you want
|
|
# THIS Caddy to also serve /.well-known/webfinger (OIDC discovery for Tailscale
|
|
# et al.) at the apex. When set, deploy.sh appends a second site block.
|
|
# Otherwise use the dedicated `webfinger` deployment.
|
|
# BASE_DOMAIN apex to serve webfinger from (e.g. example.com)
|
|
# REDIRECT_URL where non-webfinger requests to the apex are 301'd
|
|
# If you set one you must set both.
|
|
BASE_DOMAIN=
|
|
REDIRECT_URL=
|
|
|
|
# ─── Image tags ─────────────────────────────────────────────────────────────
|
|
# Pin for reproducible deploys.
|
|
POCKETID_TAG=v2.8.0
|
|
CADDY_TAG=2-alpine
|
|
ANUBIS_TAG=latest
|