6675f2a169
- Updated Docker Compose files to use digest-pinned images for CI contexts. - Enhanced Dockerfile to pin Go tool installations and verify external downloads with SHA256 checksums. - Added Renovate configuration for tracking Go tool versions and digest updates. - Introduced a new design document outlining the architecture and data flow for dependency tracking. - Created tasks and requirements documentation to ensure compliance with the new digest pinning policy. - Updated security documentation to reflect the new digest pinning policy and exceptions.
45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
# Development override - use with: docker-compose -f docker-compose.yml -f docker-compose.dev.yml up
|
|
|
|
services:
|
|
app:
|
|
# Override for local testing:
|
|
# CHARON_DEV_IMAGE=ghcr.io/wikid82/charon:dev
|
|
image: ${CHARON_DEV_IMAGE:-ghcr.io/wikid82/charon:dev@sha256:8ed38f884c217ee09da02d5b7ba990fa22ccdd4fb0d2e01a4da1b5963301104f}
|
|
# Development: expose Caddy admin API externally for debugging
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
- "443:443/udp"
|
|
- "8080:8080"
|
|
- "2019:2019" # Caddy admin API (dev only)
|
|
environment:
|
|
- CHARON_ENV=development
|
|
- CPM_ENV=development
|
|
- CHARON_HTTP_PORT=8080
|
|
- CPM_HTTP_PORT=80
|
|
# Generate with: openssl rand -base64 32
|
|
- CHARON_ENCRYPTION_KEY=your-32-byte-base64-key-here
|
|
- CHARON_DB_PATH=/app/data/charon.db
|
|
- CHARON_FRONTEND_DIR=/app/frontend/dist
|
|
- CHARON_CADDY_ADMIN_API=http://localhost:2019
|
|
- CHARON_CADDY_CONFIG_DIR=/app/data/caddy
|
|
# Security Services (Optional)
|
|
# 🚨 DEPRECATED: Use GUI toggle in Security dashboard instead
|
|
#- CPM_SECURITY_CROWDSEC_MODE=disabled # ⚠️ DEPRECATED
|
|
#- CPM_SECURITY_CROWDSEC_API_URL= # ⚠️ DEPRECATED
|
|
#- CPM_SECURITY_CROWDSEC_API_KEY= # ⚠️ DEPRECATED
|
|
#- CPM_SECURITY_WAF_MODE=disabled
|
|
#- CPM_SECURITY_RATELIMIT_ENABLED=false
|
|
#- CPM_SECURITY_ACL_ENABLED=false
|
|
- FEATURE_CERBERUS_ENABLED=true
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro # For local container discovery
|
|
- crowdsec_data:/app/data/crowdsec
|
|
# Mount your existing Caddyfile for automatic import (optional)
|
|
# - ./my-existing-Caddyfile:/import/Caddyfile:ro
|
|
# - ./sites:/import/sites:ro # If your Caddyfile imports other files
|
|
|
|
volumes:
|
|
crowdsec_data:
|
|
driver: local
|