Timmy
bbe6f339c7
- Add docker-compose.yml with PostgreSQL and CodiMD services - Add .env.example for environment configuration template - Add .gitignore to exclude sensitive data and persisted volumes - Add CLAUDE.md documentation for deployment guidance - Security hardening: read-only containers, health checks, network isolation Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
63 lines
1.6 KiB
YAML
63 lines
1.6 KiB
YAML
services:
|
|
database:
|
|
image: postgres:16-alpine
|
|
container_name: codimd-postgres
|
|
environment:
|
|
- POSTGRES_USER=${POSTGRES_USER}
|
|
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
|
- POSTGRES_DB=${POSTGRES_DB}
|
|
# PostgreSQL security settings
|
|
- POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
|
|
volumes:
|
|
- ./pgdata:/var/lib/postgresql/data
|
|
restart: always
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- codimd-network
|
|
# Security: restrict to internal network only
|
|
ports: []
|
|
# Additional security options
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
- /var/run/postgresql
|
|
|
|
codimd:
|
|
image: hackmdio/hackmd:2.6.1
|
|
container_name: codimd-app
|
|
environment:
|
|
- CMD_DB_URL=${CMD_DB_URL}
|
|
- CMD_USECDN=false
|
|
- CMD_SESSION_SECRET=${CMD_SESSION_SECRET}
|
|
- CMD_SESSION_LIFETIME=1209600000
|
|
- CMD_PORT=3000
|
|
depends_on:
|
|
database:
|
|
condition: service_healthy
|
|
ports:
|
|
- "127.0.0.1:3000:3000"
|
|
volumes:
|
|
- ./upload-data:/home/hackmd/app/public/uploads
|
|
restart: always
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/healthz"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
networks:
|
|
- codimd-network
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
networks:
|
|
codimd-network:
|
|
driver: bridge
|
|
internal: false
|