72 lines
2.7 KiB
YAML
72 lines
2.7 KiB
YAML
# The Old Fitz — production compose for the VPS.
|
|
#
|
|
# Expected layout, one folder per site:
|
|
# theoldfitz/
|
|
# docker-compose.yaml (this file)
|
|
# .env (optional, see PROXY_NETWORK below)
|
|
# www/ (contents of `npm run dist`)
|
|
# config/config.php (live secrets — never inside www/, never in dist/)
|
|
# data/ (fitz.sqlite + cache/ — never inside www/)
|
|
#
|
|
# First run: create data/ and `chown 33:33 data` (www-data in the image).
|
|
# Copy config.example.php to config/config.php, fill it in, and make it
|
|
# readable by www-data (`chown root:33` + `chmod 640`). Then create the
|
|
# first admin with bin/create-user.php (see its header).
|
|
#
|
|
# The CasaOS dev host keeps its own copy of this file in the CasaOS app
|
|
# settings, with CasaOS paths and its x-casaos block.
|
|
|
|
name: the-old-fitz
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
# The reverse proxy's Docker network (NPM or Caddy). Set PROXY_NETWORK
|
|
# in .env if it isn't called "proxy".
|
|
name: ${PROXY_NETWORK:-proxy}
|
|
|
|
services:
|
|
the-old-fitz:
|
|
image: php:8.5-apache
|
|
container_name: the-old-fitz
|
|
restart: unless-stopped
|
|
# The image ships without a php.ini, so PHP falls back to dev-style
|
|
# defaults and shows errors (with server paths) to visitors. Activate
|
|
# the image's bundled production ini — display_errors off, errors to
|
|
# the log — and hide the PHP version header, then start Apache as usual.
|
|
# Paths are spelled out (the image's $PHP_INI_DIR) rather than using
|
|
# the variable, so no $-escaping is needed.
|
|
command:
|
|
- bash
|
|
- -c
|
|
- cp /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini && echo 'expose_php = Off' > /usr/local/etc/php/conf.d/zz-hardening.ini && exec apache2-foreground
|
|
networks:
|
|
- proxy
|
|
volumes:
|
|
- type: bind
|
|
source: ./www
|
|
target: /var/www/html
|
|
# Database and cache live outside the web root so Apache can't serve
|
|
# them and deploys to www/ never touch them.
|
|
- type: bind
|
|
source: ./data
|
|
target: /var/www/data
|
|
# Config is mounted as a directory, not a single file: a single-file
|
|
# bind mount pins the inode, so an editor that saves by replacing the
|
|
# file leaves the container reading the old copy until a restart.
|
|
- type: bind
|
|
source: ./config
|
|
target: /var/www/config
|
|
read_only: true
|
|
environment:
|
|
- TZ=America/Indiana/Indianapolis
|
|
- FITZ_DB_PATH=/var/www/data/fitz.sqlite
|
|
- FITZ_CACHE_DIR=/var/www/data/cache
|
|
- FITZ_CONFIG_PATH=/var/www/config/config.php
|
|
# Cap container logs so PHP's error log can't slowly fill the disk.
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: 10m
|
|
max-file: "3"
|