Tizian 「ティツィアーン」
4b45cacfa4
An instance may now run services beside itself, each a compose file of its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose. jellyfin.yaml), so the deploy runs them with the instance. The first is Jellyfin, which people watch and listen to learn from: the instance then suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its site, refusing every change to a user from outside, so a passwordless demo account stays everyone's; its admin signs in through an SSH tunnel. The instance's compose gets a second network, `edge`, for Caddy (at a fixed address, which sidecars trust as their proxy) and the server; Postgres stays on the internal one. Caddy loses its needless way to Postgres, and a sidecar never gains one. A sidecar publishes no port, as the CI runner may reach 127.0.0.1, and runs as a user ID of its own. Caddy imports the sidecars' sites from sidecars/, mounted by their compose files (none without), and redeploy.sh recreates it when one changes. sidecars/README.md has the steps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
58 lines
3.1 KiB
Shell
58 lines
3.1 KiB
Shell
# Copy to deploy/.env, restrict it (chmod 600), and fill in. deploy/.env is git-ignored
|
|
# and never goes into an image. How it reaches the server is decided when the server is
|
|
# set up (e.g. rendered from Proton Pass on the deploying machine and copied over SSH,
|
|
# so the server itself never holds Proton credentials).
|
|
|
|
# `http://localhost` for the local rehearsal; `learn.halkyon.eu` on its server.
|
|
DOMAIN=http://localhost
|
|
|
|
# Sidecars switched on beside the instance (sidecars/README.md), each by its compose file
|
|
# after the instance's own: compose.jellyfin.yaml, a Jellyfin people watch and listen to
|
|
# learn from. Unset: the instance alone.
|
|
#COMPOSE_FILE=compose.yaml:compose.jellyfin.yaml
|
|
|
|
# With the Jellyfin sidecar: the domain it answers at, which the instance then suggests
|
|
# to its people (the app's Jellyfin sign-in fills it in).
|
|
#JELLYFIN_DOMAIN=jellyfin.example.org
|
|
|
|
# Postgres password, shared by the postgres and server services.
|
|
# Generate: openssl rand -base64 32
|
|
POSTGRES_PASSWORD=
|
|
|
|
# Pepper for hashing session keys (server-side sessions). NEVER change it once
|
|
# sessions exist: everyone would be signed out, and anonymous accounts can't sign
|
|
# back in. Rotation only via fallbackSessionKeyHashPeppers.
|
|
# Generate: openssl rand -base64 32
|
|
SESSION_KEY_HASH_PEPPER=
|
|
|
|
# GitHub sign-in (optional): the client ID and secret of this instance's own GitHub
|
|
# OAuth app (GitHub → Settings → Developer settings → OAuth Apps), registered with the
|
|
# callback URLs app.halkyon.learn://github-callback and http://127.0.0.1/github-callback.
|
|
# Empty: GitHub sign-in is off, and the app doesn't offer it.
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
|
|
# Where the source of what this instance runs is, shown in the app's About dialog: both
|
|
# licences (AGPL for the app, SSPL for the server) require offering it to the people who
|
|
# use the instance. Empty: the project's repository, which is right for unmodified code.
|
|
# Running modified code, set it to where your modified source is published.
|
|
SOURCE_URL=
|
|
|
|
# The Jellyfin server the app suggests to this instance's people, who watch and listen
|
|
# to learn from it (Halkyon Learn's Watch screen). Empty: `https://jellyfin.` on the
|
|
# domain registered for this instance (learn.example.org → jellyfin.example.org), if a
|
|
# Jellyfin server answers there; `none`: no suggestion.
|
|
JELLYFIN_URL=
|
|
|
|
# How much room people's images and sounds may take on this instance, in MiB. Empty: the
|
|
# defaults, 100 for an anonymous person (anonymous accounts are meant to become identified
|
|
# ones), 500 for one signed in with GitHub, and 15000 for everyone together (0: no limit
|
|
# for everyone together). Every file is in the database, so also in each of the 3 dumps
|
|
# this server keeps (and a fourth while a deploy writes its own): files take five times
|
|
# their size on the disk. One person may get more than the default; as the operator,
|
|
# in deploy/ (their id is their account's, "authUserId"):
|
|
# docker compose exec postgres psql -U halkyon_learn -d halkyon_learn -c "INSERT INTO
|
|
# file_allowance (\"authUserId\", \"maxBytes\", note) VALUES ('<id>', 2147483648, 'asked by mail')"
|
|
FILE_LIMIT_ANONYMOUS_MB=
|
|
FILE_LIMIT_IDENTIFIED_MB=
|
|
FILE_LIMIT_INSTANCE_MB=
|