portal-tunnel/docker-compose.yml at 383c81debfe76b93ea6f01a86335e60c0df076b5 · gosuda/portal-tunnel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
services:
  portal:
    image: ghcr.io/gosuda/portal:2
    build:
      context: .
      dockerfile: Dockerfile
    stop_grace_period: 30s
    # Binding the default embedded DNS port 53 as a nonroot container.
    cap_add:
      - NET_BIND_SERVICE
    ports:
      - "443:443"
      - "${WIREGUARD_PORT:-51820}:${WIREGUARD_PORT:-51820}/udp"
      # Embedded authoritative DNS (the default DNS provider).
      - "${EMBEDDED_DNS_PORT:-53}:${EMBEDDED_DNS_PORT:-53}/tcp"
      - "${EMBEDDED_DNS_PORT:-53}:${EMBEDDED_DNS_PORT:-53}/udp"
      # Uncomment for UDP backhaul, public UDP lease ports, and raw TCP lease ports as needed.
      # - "443:443/udp"
      # - "${MIN_PORT:-40000}-${MAX_PORT:-40009}:${MIN_PORT:-40000}-${MAX_PORT:-40009}/udp"
      # - "${MIN_PORT:-40000}-${MAX_PORT:-40009}:${MIN_PORT:-40000}-${MAX_PORT:-40009}"
      # Uncomment with PPROF_ENABLED=true and PPROF_ADDR=:6060 to inspect pprof from the host.
      # - "${PPROF_PORT:-6060}:${PPROF_PORT:-6060}"
    environment:
      # Public routing, discovery, and relay identity persistence
      PORTAL_URL: ${PORTAL_URL:-https://localhost}
      PORTAL_FRONTEND_DIR: ${PORTAL_FRONTEND_DIR:-}
      BOOTSTRAPS: ${BOOTSTRAPS:-}
      DISCOVERY: ${DISCOVERY:-false}
      IVNP_ENABLED: ${IVNP_ENABLED:-false}
      IVNP_CONFIG: ${IVNP_CONFIG:-}
      IDENTITY_PATH: ${IDENTITY_PATH:-/portal-certs}

      API_PORT: 4017
      SNI_PORT: 443
      WIREGUARD_PORT: ${WIREGUARD_PORT:-51820}

      # Shared lease port range.
      MIN_PORT: ${MIN_PORT:-40000}
      MAX_PORT: ${MAX_PORT:-40009}
      UDP_ENABLED: ${UDP_ENABLED:-false}
      TCP_ENABLED: ${TCP_ENABLED:-false}

      # Admin/auth configuration.
      ADMIN_TOKEN: ${ADMIN_TOKEN:-}
      LANDING_PAGE_ENABLED: ${LANDING_PAGE_ENABLED:-false}
      TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
      TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-}

      # Optional diagnostics; keep loopback unless the pprof port is protected.
      PPROF_ENABLED: ${PPROF_ENABLED:-false}
      PPROF_ADDR: ${PPROF_ADDR:-127.0.0.1:6060}

      # TLS/ACME materials and DNS automation
      ACME_DNS_PROVIDER: ${ACME_DNS_PROVIDER:-}
      EMBEDDED_DNS_PORT: ${EMBEDDED_DNS_PORT:-53}
      ENS_GASLESS_ENABLED: ${ENS_GASLESS_ENABLED:-false}
      CLOUDFLARE_TOKEN: ${CLOUDFLARE_TOKEN:-}
      GCP_PROJECT_ID: ${GCP_PROJECT_ID:-}
      GCP_MANAGED_ZONE: ${GCP_MANAGED_ZONE:-}
      GOOGLE_APPLICATION_CREDENTIALS: ${GOOGLE_APPLICATION_CREDENTIALS:-}
      HETZNER_API_TOKEN: ${HETZNER_API_TOKEN:-}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
      AWS_REGION: ${AWS_REGION:-}
      AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION:-}
      AWS_HOSTED_ZONE_ID: ${AWS_HOSTED_ZONE_ID:-}
      AWS_DNSSEC_KMS_KEY_ARN: ${AWS_DNSSEC_KMS_KEY_ARN:-}
      VULTR_API_KEY: ${VULTR_API_KEY:-}
      NJALLA_TOKEN: ${NJALLA_TOKEN:-}
    volumes:
      - ./.portal-certs:${IDENTITY_PATH:-/portal-certs}
      # To replace the embedded SPA, set PORTAL_FRONTEND_DIR=/srv/portal/frontend
      # and uncomment this read-only mount.
      # - ./community-frontend/dist:/srv/portal/frontend:ro
      # Uncomment when using a Google Cloud service account file for gcloud automation.
      # - ./gcp-dns.json:/run/secrets/gcp-dns.json:ro
    restart: unless-stopped