mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
d0d153b768
- ARTEX_TRUSTED_PROXIES (comma-separated CIDRs, empty by default). When the TCP peer is listed, the login limit reads X-Forwarded-For from the right and keys on the first hop that is not a trusted proxy; otherwise the header is ignored. Without it every client behind a reverse proxy shares one bucket and an attacker can block the admin. Passed through by docker-compose.yml and listed in .env.example. - README: nginx example sends X-Forwarded-For; document the variable; the binary's default listen address is 127.0.0.1:8787. - reset-password.sh refuses passwords under 12 characters, counted in characters like the server.
56 lines
2.1 KiB
YAML
56 lines
2.1 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-artex}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Please set POSTGRES_PASSWORD in .env}
|
|
POSTGRES_DB: ${POSTGRES_DB:-artex}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-artex} -d ${POSTGRES_DB:-artex}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
|
|
artex:
|
|
# Built from this checkout. The previous reference was a third-party
|
|
# namespace whose repository is gone: whoever controls that name could
|
|
# publish the tag this file would pull.
|
|
build:
|
|
context: .
|
|
args:
|
|
ARTEX_VERSION: ${ARTEX_VERSION:-dev}
|
|
image: artex:local
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
ARTEX_PG_DSN: postgres://${POSTGRES_USER:-artex}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-artex}?sslmode=disable
|
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
|
|
OPENAI_API_KEY: ${OPENAI_API_KEY:-}
|
|
ARTEX_LLM_PROVIDER: ${ARTEX_LLM_PROVIDER:-}
|
|
ARTEX_LLM_MODEL: ${ARTEX_LLM_MODEL:-}
|
|
ARTEX_LLM_BASE_URL: ${ARTEX_LLM_BASE_URL:-}
|
|
ARTEX_LLM_PROXY: ${ARTEX_LLM_PROXY:-}
|
|
ARTEX_JWT_KEY_DIR: /app/keys
|
|
ARTEX_TRUSTED_PROXIES: ${ARTEX_TRUSTED_PROXIES:-}
|
|
ports:
|
|
- "${ARTEX_BIND_ADDR:-127.0.0.1}:8787:8787"
|
|
- "127.0.0.1:8788:8788"
|
|
volumes:
|
|
# Bind the data directory (SQLite, task files, etc.) to data/ in the project root,
|
|
# so it is easy to inspect/back up on the host and survives container rebuilds.
|
|
- ./data:/app/data
|
|
# JWT signing key (jwt.key), kept out of data/, which the file manager browses.
|
|
# Persisting it keeps users signed in across container rebuilds.
|
|
- ./keys:/app/keys
|
|
# Mount skills/ from the project root into the container (overriding the image's built-in /app/skills);
|
|
# skill changes require no image rebuild — the container reads the host copy.
|
|
- ./skills:/app/skills
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
pgdata:
|