90 lines
3.0 KiB
YAML
90 lines
3.0 KiB
YAML
# pocket-id stack — caddy (TLS) + anubis (PoW anti-bot) + pocket-id.
|
|
#
|
|
# Topology:
|
|
# Internet --> caddy:443 --> anubis-pid:8923 --> pocket-id:1411
|
|
#
|
|
# Only caddy publishes ports. pocket-id and anubis are internal-only and
|
|
# reachable by service name. To bypass anubis (no PoW challenge), point the
|
|
# Caddyfile reverse_proxy at pocket-id:1411 directly and remove the anubis
|
|
# block.
|
|
|
|
name: pocket-id
|
|
|
|
volumes:
|
|
pocket-id-data:
|
|
caddy-data:
|
|
caddy-config:
|
|
|
|
services:
|
|
# ---------------------------------------------------------------------------
|
|
# Caddy — TLS termination + reverse proxy. The only service on 80/443.
|
|
# Auto-issues Let's Encrypt cert for ${POCKETID_DOMAIN}.
|
|
# ---------------------------------------------------------------------------
|
|
caddy:
|
|
image: caddy:${CADDY_TAG:-2-alpine}
|
|
container_name: caddy
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
- "443:443/udp" # HTTP/3
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy-data:/data
|
|
- caddy-config:/config
|
|
environment:
|
|
POCKETID_DOMAIN: "${POCKETID_DOMAIN}"
|
|
ACME_EMAIL: "${ACME_EMAIL}"
|
|
depends_on:
|
|
- pocket-id
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:2019/config/"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Pocket-ID — OIDC provider. No host port published; Caddy fronts it.
|
|
# TRUST_PROXY=true is required so client IPs and scheme are read from
|
|
# X-Forwarded-* headers Caddy sets.
|
|
# ---------------------------------------------------------------------------
|
|
pocket-id:
|
|
image: ghcr.io/pocket-id/pocket-id:${POCKETID_TAG:-v2}
|
|
container_name: pocket-id
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
# Override .env defaults so the container always sees the right values
|
|
# regardless of how .env is laid out.
|
|
APP_URL: "https://${POCKETID_DOMAIN}"
|
|
TRUST_PROXY: "true"
|
|
volumes:
|
|
- pocket-id-data:/app/data
|
|
healthcheck:
|
|
test: ["CMD", "/app/pocket-id", "healthcheck"]
|
|
interval: 90s
|
|
timeout: 5s
|
|
retries: 2
|
|
start_period: 10s
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Anubis — PoW anti-bot sidecar in front of pocket-id. Generate the key
|
|
# with `openssl rand -hex 32`. To disable: comment this service out and
|
|
# change the Caddyfile reverse_proxy target to `pocket-id:1411`.
|
|
# ---------------------------------------------------------------------------
|
|
anubis-pid:
|
|
image: ghcr.io/techarohq/anubis:${ANUBIS_TAG:-latest}
|
|
container_name: anubis-pid
|
|
restart: unless-stopped
|
|
environment:
|
|
BIND: ":8923"
|
|
TARGET: "http://pocket-id:1411"
|
|
DIFFICULTY: "4" # SHA-256 leading zeros; 4 ≈ 1s client work
|
|
COOKIE_DOMAIN: "${POCKETID_DOMAIN}"
|
|
METRICS_BIND: ":9090"
|
|
ED25519_PRIVATE_KEY_HEX: "${ANUBIS_PID_KEY}"
|
|
depends_on:
|
|
pocket-id:
|
|
condition: service_healthy
|