ekklesiaandClaude Opus 5.5
f1d6501239
CI / verify (pull_request) Successful in 1m51s
CI / infrastructure-smoke (pull_request) Successful in 20s
CI / migration-smoke (pull_request) Successful in 1m48s
CI / image-build (pull_request) Successful in 35s
CI / deploy-smoke (same-origin) (pull_request) Successful in 50s
CI / deploy-smoke (split) (pull_request) Successful in 1m16s
Doctor checks the client-address configuration of the process it runs in, and operators run it as `migrate`. The proxy overlay set trusted-proxy mode on `api` only, so Doctor reported "Direct client-address mode" for an installation that trusts its proxy. - compose.proxy.yaml defines the three variables once, as a YAML anchor, and applies it to both `api` and `migrate`. Rendered with `docker compose config`, `api` is unchanged and `migrate` now matches it, keeping NODE_EXTRA_CA_CERTS from the base. - The example deploy/.env sets COMPOSE_FILE=compose.yaml:compose.proxy.yaml, as the instance already does. Plain `docker compose run --rm migrate ...` in the README then runs with the overlay; it used to read compose.yaml alone. - Every client-address check in Doctor now says it checked the environment Doctor runs with, and how to read the running API's own value (`docker compose exec api printenv EKKLESIA_CLIENT_ADDRESS_MODE`, confirmed to work in the image). - The deploy README explains why operator commands need the same files as the stack. Co-Authored-By: Claude Opus 5.5 <[email protected]>
41 lines
2.2 KiB
Bash
41 lines
2.2 KiB
Bash
# Non-secret settings for the reference deployment's Compose project. Copy to deploy/.env, which
|
|
# Compose reads automatically from this directory. Nothing here is a secret; secrets live in the
|
|
# per-service files under EKKLESIA_ENV_DIR.
|
|
|
|
# Which Compose files make up this installation, so that every plain `docker compose …` command
|
|
# run from this directory, operator commands through `migrate` included, sees the same services and
|
|
# settings as the running stack. Add compose.tunnel.yaml if you use the tunnel connector. Without
|
|
# the proxy overlay here, Doctor checks a `migrate` that lacks the API's client-address settings.
|
|
COMPOSE_FILE=compose.yaml:compose.proxy.yaml
|
|
|
|
# The image to run, by registry, name, and tag (or digest). Required.
|
|
EKKLESIA_IMAGE=
|
|
|
|
# Where the root-owned, mode-600 env files and the TLS directory live on the host.
|
|
EKKLESIA_ENV_DIR=/etc/ekklesia
|
|
EKKLESIA_TLS_DIR=/etc/ekklesia/tls
|
|
|
|
# --- compose.proxy.yaml ---------------------------------------------------------------------------
|
|
# The Ekklesia hostname and the storage hostname (signed object URLs). In the default same-origin
|
|
# topology (Caddyfile.example) EKKLESIA_HOSTNAME serves the Dashboard, the API, and displays.
|
|
EKKLESIA_HOSTNAME=
|
|
EKKLESIA_STORAGE_HOSTNAME=
|
|
# The split topology only (ADR 0045, Caddyfile.split.example): the Dashboard's own hostname, while
|
|
# EKKLESIA_HOSTNAME is the API's and the displays'. Both must share one registrable domain, for
|
|
# example dash.example.org and api.example.org. Leave empty for the same-origin topology.
|
|
EKKLESIA_DASHBOARD_HOSTNAME=
|
|
# Contact address for the ACME account (certificate expiry notices).
|
|
EKKLESIA_ACME_EMAIL=
|
|
# EKKLESIA_CADDYFILE=./Caddyfile
|
|
# EKKLESIA_PUBLISH_ADDRESS=0.0.0.0
|
|
# EKKLESIA_HTTP_PORT=80
|
|
# EKKLESIA_HTTPS_PORT=443
|
|
|
|
# The edge network. Change the subnet only if it collides with one already on the host. Docker
|
|
# assigns dynamic addresses only from EKKLESIA_EDGE_DYNAMIC_RANGE (the lower half); the proxy and
|
|
# the tunnel connector take fixed addresses from the upper half, so nothing else can ever hold them.
|
|
# EKKLESIA_EDGE_SUBNET=10.249.250.0/24
|
|
# EKKLESIA_EDGE_DYNAMIC_RANGE=10.249.250.0/25
|
|
# EKKLESIA_PROXY_ADDRESS=10.249.250.254
|
|
# EKKLESIA_TUNNEL_ADDRESS=10.249.250.253
|