Timmy
bbe6f339c7
- Add docker-compose.yml with PostgreSQL and CodiMD services - Add .env.example for environment configuration template - Add .gitignore to exclude sensitive data and persisted volumes - Add CLAUDE.md documentation for deployment guidance - Security hardening: read-only containers, health checks, network isolation Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
51 lines
1.8 KiB
Markdown
51 lines
1.8 KiB
Markdown
# CLAUDE.md
|
|
|
|
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
|
|
|
|
## Overview
|
|
|
|
This directory contains Docker deployment configuration for CodiMD (now HackMD), a collaborative markdown editor. **This is not a source code repository** - the actual CodiMD source code is maintained at https://github.com/hackmdio/codimd.
|
|
|
|
## Architecture
|
|
|
|
This deployment consists of two Docker services:
|
|
|
|
- **database**: PostgreSQL 16 Alpine with security hardening, stores data at `./pgdata/`
|
|
- **codimd**: The main application (hackmdio/hackmd:2.6.1) serving on port 3000, with uploads stored at `./upload-data/`
|
|
|
|
All persistent data is stored in the current directory:
|
|
- `./pgdata/` - PostgreSQL database files
|
|
- `./upload-data/` - User uploaded files
|
|
|
|
## Running the Application
|
|
|
|
```bash
|
|
# First time setup: copy and customize environment variables
|
|
cp .env.example .env
|
|
# Edit .env with strong passwords
|
|
|
|
# Start all services
|
|
docker-compose up -d
|
|
|
|
# View logs
|
|
docker-compose logs -f
|
|
|
|
# Stop services
|
|
docker-compose down
|
|
```
|
|
|
|
The application will be available at http://localhost:3000 (bound to 127.0.0.1 only)
|
|
|
|
## Security Configuration
|
|
|
|
The deployment includes several security improvements:
|
|
|
|
- **Environment variables**: All secrets stored in `.env` file (git-ignored)
|
|
- **PostgreSQL hardening**: Read-only container, no new privileges, tmpfs for temporary data
|
|
- **Network isolation**: Services communicate via internal Docker network, database not exposed externally
|
|
- **Health checks**: Both services have health checks for proper startup sequencing
|
|
- **Local-only binding**: CodiMD binds to 127.0.0.1, not accessible from external network
|
|
- **Session secret**: Auto-generated random secret for session encryption
|
|
|
|
**Important**: Change the default passwords in `.env` before production use.
|