Files

Timmy bbe6f339c7 Initial commit: CodiMD Docker deployment with security hardening

- Add docker-compose.yml with PostgreSQL and CodiMD services
- Add .env.example for environment configuration template
- Add .gitignore to exclude sensitive data and persisted volumes
- Add CLAUDE.md documentation for deployment guidance
- Security hardening: read-only containers, health checks, network isolation

Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>

2026-03-17 15:00:48 +08:00

1.8 KiB

Raw Blame History

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Overview

This directory contains Docker deployment configuration for CodiMD (now HackMD), a collaborative markdown editor. This is not a source code repository - the actual CodiMD source code is maintained at https://github.com/hackmdio/codimd.

Architecture

This deployment consists of two Docker services:

database: PostgreSQL 16 Alpine with security hardening, stores data at ./pgdata/
codimd: The main application (hackmdio/hackmd:2.6.1) serving on port 3000, with uploads stored at ./upload-data/

All persistent data is stored in the current directory:

./pgdata/ - PostgreSQL database files
./upload-data/ - User uploaded files

Running the Application

# First time setup: copy and customize environment variables
cp .env.example .env
# Edit .env with strong passwords

# Start all services
docker-compose up -d

# View logs
docker-compose logs -f

# Stop services
docker-compose down

The application will be available at http://localhost:3000 (bound to 127.0.0.1 only)

Security Configuration

The deployment includes several security improvements:

Environment variables: All secrets stored in .env file (git-ignored)
PostgreSQL hardening: Read-only container, no new privileges, tmpfs for temporary data
Network isolation: Services communicate via internal Docker network, database not exposed externally
Health checks: Both services have health checks for proper startup sequencing
Local-only binding: CodiMD binds to 127.0.0.1, not accessible from external network
Session secret: Auto-generated random secret for session encryption

Important: Change the default passwords in .env before production use.