openconcho/docker-compose.yml at main · offendingcommit/openconcho · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# OpenConcho web UI — one file, two Compose profiles (dev builds, prod pulls).
#
#   make up      # profile dev:  build from THIS repo + run     → http://localhost:8080
#   make prod    # profile prod: pull ghcr…:latest instead of building
#   make down    # stop + remove (either profile)
#   make clean   # down + drop the locally built image
#
# The SPA issues all Honcho calls same-origin to /api; nginx forwards each to the
# URL named in the per-request X-Honcho-Upstream header (no browser CORS). Seed the
# first instance with OPENCONCHO_DEFAULT_HONCHO_URL:
#
#   OPENCONCHO_DEFAULT_HONCHO_URL=https://honcho.example.net make up
#
# To fold into an existing Honcho Compose stack, point the seed at the api service
# (e.g. http://api:8000 — nginx resolves it on the compose network).

# Shared config (defined once); both profiles reference it via a YAML merge.
x-openconcho: &openconcho
  environment:
    # Absolute URL seeding the first instance; the browser sends it as the
    # X-Honcho-Upstream header and nginx forwards there (no browser CORS).
    OPENCONCHO_DEFAULT_HONCHO_URL: ${OPENCONCHO_DEFAULT_HONCHO_URL:-http://host.docker.internal:8000}
    # Optional SSRF guard. Unset = forward anywhere (safe for the localhost-only
    # binding below). Set comma-separated host globs before exposing the proxy:
    #   OPENCONCHO_UPSTREAM_ALLOWLIST: honcho.example.net,*.honcho.dev
    OPENCONCHO_UPSTREAM_ALLOWLIST: ${OPENCONCHO_UPSTREAM_ALLOWLIST:-}
  ports:
    - "127.0.0.1:8080:8080"
  # Lets the default host.docker.internal upstream resolve on Linux too
  # (Docker Desktop / Colima provide it automatically).
  extra_hosts:
    - "host.docker.internal:host-gateway"
  restart: unless-stopped

services:
  # Dev-forward — builds from source so you run your local changes (`make up`).
  openconcho:
    <<: *openconcho
    profiles: ["dev"]
    build: .
    image: openconcho-web:local

  # Production — pulls the published image instead of building (`make prod`).
  openconcho-prod:
    <<: *openconcho
    profiles: ["prod"]
    image: ghcr.io/offendingcommit/openconcho-web:latest
    pull_policy: always