mirror of
https://github.com/gl-inet/glkvm-cloud.git
synced 2026-09-11 21:38:55 +00:00
GL.iNet-Yongping.Xie
ce05341dae
Coturn image defaults to nobody and cannot read the bind-mounted entrypoint on stricter hosts (e.g. NAS), causing Permission denied. The allowed-peer-ip=0.0.0.0/0 CIDR is rejected by coturn as well. Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
97 lines
3.9 KiB
YAML
Executable File
97 lines
3.9 KiB
YAML
Executable File
services:
|
|
rttys:
|
|
image: ${GLKVM_IMAGE:-glzhitong/glkvm-cloud:latest}
|
|
container_name: glkvm_cloud
|
|
restart: always
|
|
environment:
|
|
# Preferred: set GLKVM_ACCESS_IP explicitly; if empty, entrypoint will auto-detect once.
|
|
GLKVM_ACCESS_IP: ${GLKVM_ACCESS_IP:-}
|
|
|
|
# ---- rttys ----
|
|
RTTYS_TOKEN: ${RTTYS_TOKEN:-DeviceTokenYouCanChangeMe}
|
|
RTTYS_PASS: ${RTTYS_PASS:-StrongP@ssw0rd}
|
|
RTTYS_ADMIN_NAME: ${RTTYS_ADMIN_NAME:-}
|
|
|
|
# Ports inside container (mirrored to host via `ports` below)
|
|
RTTYS_DEVICE_PORT: ${RTTYS_DEVICE_PORT:-5912} # addr-dev
|
|
RTTYS_WEBUI_PORT: ${RTTYS_WEBUI_PORT:-443} # addr-user
|
|
RTTYS_HTTP_PROXY_PORT: ${RTTYS_HTTP_PROXY_PORT:-10443} # addr-http-proxy
|
|
|
|
# WebRTC / TURN reference (used by rttys template)
|
|
TURN_PORT: ${TURN_PORT:-3478}
|
|
TURN_USER: ${TURN_USER:-glkvmcloudwebrtcuser}
|
|
TURN_PASS: ${TURN_PASS:-AnotherS3cret}
|
|
|
|
# ---- LDAP Configuration ----
|
|
LDAP_ENABLED: ${LDAP_ENABLED:-false}
|
|
LDAP_SERVER: ${LDAP_SERVER:-}
|
|
LDAP_PORT: ${LDAP_PORT:-389}
|
|
LDAP_USE_TLS: ${LDAP_USE_TLS:-false}
|
|
LDAP_BIND_DN: ${LDAP_BIND_DN:-}
|
|
LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-}
|
|
LDAP_BASE_DN: ${LDAP_BASE_DN:-}
|
|
LDAP_USER_FILTER: ${LDAP_USER_FILTER:-(uid=%s)}
|
|
LDAP_ALLOWED_GROUPS: ${LDAP_ALLOWED_GROUPS:-}
|
|
LDAP_ALLOWED_USERS: ${LDAP_ALLOWED_USERS:-}
|
|
LDAP_ADMIN_GROUP: ${LDAP_ADMIN_GROUP:-}
|
|
LDAP_ADMIN_USERS: ${LDAP_ADMIN_USERS:-}
|
|
|
|
# ---- OIDC Authentication ----
|
|
OIDC_ENABLED: ${OIDC_ENABLED:-false}
|
|
OIDC_ISSUER: ${OIDC_ISSUER:-}
|
|
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
|
|
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
|
|
OIDC_AUTH_URL: ${OIDC_AUTH_URL:-}
|
|
OIDC_TOKEN_URL: ${OIDC_TOKEN_URL:-}
|
|
OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
|
|
OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email}
|
|
# Whitelists (optional)
|
|
OIDC_ALLOWED_USERS: ${OIDC_ALLOWED_USERS:-}
|
|
OIDC_ALLOWED_SUBS: ${OIDC_ALLOWED_SUBS:-}
|
|
OIDC_ALLOWED_USERNAMES: ${OIDC_ALLOWED_USERNAMES:-}
|
|
OIDC_ALLOWED_GROUPS: ${OIDC_ALLOWED_GROUPS:-}
|
|
OIDC_ADMIN_GROUP: ${OIDC_ADMIN_GROUP:-}
|
|
OIDC_ADMIN_USERS: ${OIDC_ADMIN_USERS:-}
|
|
|
|
# ---- Selfhost WebUI URL ----
|
|
SELFHOST_WEBUI_URL: ${SELFHOST_WEBUI_URL:-}
|
|
|
|
# ---- Reverse Proxy ----
|
|
REVERSE_PROXY_ENABLED: ${REVERSE_PROXY_ENABLED:-false}
|
|
|
|
# ---- Device Endpoint Host ----
|
|
DEVICE_ENDPOINT_HOST: ${DEVICE_ENDPOINT_HOST:-}
|
|
# ---- Web UI Host ----
|
|
WEB_UI_HOST: ${WEB_UI_HOST:-}
|
|
volumes:
|
|
- ./templates/rttys.conf.template:/tpl/rttys.conf.tmpl:ro
|
|
- ./scripts/docker-entrypoint.sh:/docker-entrypoint.sh:ro
|
|
- ./certificate/glkvm.cer:/home/certificate/glkvm_cer:ro
|
|
- ./certificate/glkvm.key:/home/certificate/glkvm_key:ro
|
|
- ./database:/home/database:rw
|
|
entrypoint: ["/bin/sh", "/docker-entrypoint.sh"]
|
|
command: ["rttys"]
|
|
ports:
|
|
- "${RTTYS_WEBUI_PORT:-443}:${RTTYS_WEBUI_PORT:-443}"
|
|
- "${RTTYS_HTTP_PROXY_PORT:-10443}:${RTTYS_HTTP_PROXY_PORT:-10443}"
|
|
- "${RTTYS_DEVICE_PORT:-5912}:${RTTYS_DEVICE_PORT:-5912}"
|
|
|
|
coturn:
|
|
image: ${COTURN_IMAGE:-coturn/coturn:edge-alpine}
|
|
container_name: glkvm_coturn
|
|
restart: always
|
|
user: "0:0" # run as root so it can read the bind-mounted entrypoint
|
|
environment:
|
|
# Same semantics as above: prefer explicit value, else auto-detect
|
|
GLKVM_ACCESS_IP: ${GLKVM_ACCESS_IP:-}
|
|
TURN_PORT: ${TURN_PORT:-3478}
|
|
TURN_USER: ${TURN_USER:-glkvmcloudwebrtcuser}
|
|
TURN_PASS: ${TURN_PASS:-AnotherS3cret}
|
|
entrypoint: ["/bin/sh", "/docker-entrypoint.sh"]
|
|
command: ["coturn"]
|
|
volumes:
|
|
- ./templates/turnserver.conf.template:/tpl/turnserver.conf.tmpl:ro
|
|
- ./scripts/docker-entrypoint.sh:/docker-entrypoint.sh:ro
|
|
ports:
|
|
- "${TURN_PORT:-3478}:3478/tcp"
|
|
- "${TURN_PORT:-3478}:3478/udp" |