mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-25 13:11:05 +00:00
Anso
c02dfa4fdd
* feat: listen with HTTPS so Pilot credential delivery stays confidential When the control instance is not behind a reverse proxy, cert and key files opt the process into an HTTPS listener so Pilot tunnels are encrypted. Enrollment emits an https URL and an optional CA bind-mount. Pilot agents ignore those cert files so loopback replay stays HTTP. * fix: verify native TLS health probes against the public URL Keep certificate verification on for the loopback HEALTHCHECK. Dial 127.0.0.1, check identity against SENCHO_PUBLIC_URL, and trust SENCHO_TLS_CA_FILE when set. * fix: trust HEALTHCHECK CA via the process store, not the request Private-issuer PEM is added with tls.setDefaultCACertificates so the loopback HTTPS probe never puts file bytes into https.get options.
75 lines
3.8 KiB
YAML
75 lines
3.8 KiB
YAML
services:
|
|
sencho:
|
|
image: saelix/sencho:latest
|
|
build: .
|
|
container_name: sencho
|
|
restart: unless-stopped
|
|
# Publish only the Sencho UI / API port. Sencho Mesh runs on an internal
|
|
# `sencho_mesh` Docker network that Sencho creates and joins on boot,
|
|
# so cross-stack mesh routing does not require any extra host ports or
|
|
# firewall rules. Override the mesh subnet (default 172.30.0.0/24) with
|
|
# SENCHO_MESH_SUBNET if it conflicts with your network.
|
|
ports:
|
|
- "1852:1852"
|
|
volumes:
|
|
# Required: Docker Socket for container orchestration
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
|
|
# Required: Sencho's internal database for alerts and settings
|
|
# Format is [Host Path]:[Container Path]
|
|
# You can change the left side to anywhere on your server, but leave the right side as /app/data
|
|
- ./data:/app/data
|
|
|
|
# ⚠️ THE 1:1 COMPOSE PATH RULE ⚠️
|
|
# Mount the root folder where all your compose files live.
|
|
# The path on the left (Host) MUST EXACTLY MATCH the path on the right (Container).
|
|
# EXAMPLE: If your compose files are in /opt/docker, use: - /opt/docker:/opt/docker
|
|
- /path/to/your/docker/folder:/path/to/your/docker/folder
|
|
|
|
# (Optional but Recommended) Media/Data Drives
|
|
# Mount your media drives here so Docker Compose inside Sencho can validate paths during deployment.
|
|
- /path/to/your/media/drives:/path/to/your/media/drives
|
|
|
|
# (Optional, ZFS hosts only) OpenZFS ARC stats for ZFS-aware host memory.
|
|
# ARC cache is reclaimable but the kernel reports it as used, which can
|
|
# trigger false host-memory alerts. Uncomment to let Sencho treat ARC as
|
|
# available memory. Usually already visible in the container; only needed
|
|
# if your runtime does not expose /proc/spl/kstat/zfs/arcstats.
|
|
# - /proc/spl/kstat/zfs/arcstats:/host/proc/spl/kstat/zfs/arcstats:ro
|
|
# VM ballooning: mount /proc/meminfo if your runtime does not expose it.
|
|
# - /proc/meminfo:/host/proc/meminfo:ro
|
|
# Optional: native TLS when there is no reverse proxy. See
|
|
# docs/getting-started/configuration.mdx (Native TLS on the control instance).
|
|
# - ./certs/fullchain.pem:/app/certs/fullchain.pem:ro
|
|
# - ./certs/privkey.pem:/app/certs/privkey.pem:ro
|
|
# - ./certs/ca.pem:/app/certs/ca.pem:ro
|
|
|
|
environment:
|
|
# ENVIRONMENT VARIABLES FOR INSIDE THE CONTAINER
|
|
|
|
# This points to the Container Path (right side) of your 1:1 mount above
|
|
- COMPOSE_DIR=/path/to/your/docker/folder/compose
|
|
|
|
# This points to the Container Path (right side) of your database mount above. Leave this as /app/data.
|
|
- DATA_DIR=/app/data
|
|
|
|
# (Optional, ZFS hosts only) Container-side path to the OpenZFS ARC stats
|
|
# file, if it is not at a standard location. Leave empty to auto-detect
|
|
# /host/proc/spl/kstat/zfs/arcstats then /proc/spl/kstat/zfs/arcstats.
|
|
- SENCHO_ZFS_ARCSTATS_PATH=${SENCHO_ZFS_ARCSTATS_PATH:-}
|
|
# Optional: mount /proc/meminfo for VM memory ballooning awareness
|
|
# - /proc/meminfo:/host/proc/meminfo:ro
|
|
- SENCHO_PROC_MEMINFO_PATH=${SENCHO_PROC_MEMINFO_PATH:-}
|
|
# Optional: native TLS. Uncomment with the cert volume mounts above.
|
|
# - SENCHO_PUBLIC_URL=https://192.168.1.50:1852
|
|
# - SENCHO_TLS_CERT_FILE=/app/certs/fullchain.pem
|
|
# - SENCHO_TLS_KEY_FILE=/app/certs/privkey.pem
|
|
# - SENCHO_TLS_CA_FILE=/app/certs/ca.pem
|
|
|
|
# ⚠️ GLOBAL ENVIRONMENT VARIABLES ⚠️
|
|
# If your compose files rely on host-level shell variables (like $PUID, $TZ)
|
|
# or a centralized globals.env file, you MUST pass them into Sencho here.
|
|
# Otherwise, Sencho will evaluate your compose files with empty variables.
|
|
# If you do not use a global env file, you can delete these two lines.
|
|
env_file:
|
|
- /path/to/your/docker/folder/env/globals.env |