lukas
5aa85b0920
Move all hardcoded credentials out of tracked compose/env files into the
git-crypt-encrypted secrets/ directory, using each app's supported mechanism:
- env_file -> secrets/*.env: mealie, navidrome, karakeep, meilisearch,
baserow, maloja, valheim, photoprism, komf, openldap, penpot, vaultwarden
- file:///run/secrets: authentik email password
- jelu DB password appended to existing secrets/jelu.env
Untrack root .env (interpolated ${VAR} secrets) and add sanitized
.env.example template; gitignore /.env.
Move unreferenced orphan files (mediawiki/rtorrent/snibox .env) into
secrets/ to preserve values while encrypting them.
Add SECURITY.md documenting the secrets conventions and a rotation
checklist. NOTE: all migrated values remain in prior git history and
must be rotated at their providers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
78 lines
1.4 KiB
YAML
78 lines
1.4 KiB
YAML
---
|
|
networks:
|
|
penpot:
|
|
|
|
volumes:
|
|
penpot_postgres_data:
|
|
penpot_assets_data:
|
|
|
|
services:
|
|
penpot-frontend:
|
|
image: "penpotapp/frontend:latest"
|
|
ports:
|
|
- 9001:80
|
|
|
|
volumes:
|
|
- ${DOCKER_STORAGE_PATH}/penpot/data:/opt/data$
|
|
|
|
env_file:
|
|
- penpot.env
|
|
|
|
depends_on:
|
|
- penpot-backend
|
|
- penpot-exporter
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
penpot-backend:
|
|
image: "penpotapp/backend:latest"
|
|
volumes:
|
|
- penpot_assets_data:/opt/data
|
|
|
|
depends_on:
|
|
- penpot-postgres
|
|
- penpot-redis
|
|
|
|
env_file:
|
|
- config.env
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
penpot-exporter:
|
|
image: "penpotapp/exporter:latest"
|
|
env_file:
|
|
- config.env
|
|
environment:
|
|
# Don't touch it; this uses internal docker network to
|
|
# communicate with the frontend.
|
|
- PENPOT_PUBLIC_URI=http://penpot-frontend
|
|
networks:
|
|
- penpot
|
|
|
|
penpot-postgres:
|
|
image: "postgres:14"
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
|
|
env_file:
|
|
- secrets/penpot.env
|
|
environment:
|
|
- POSTGRES_INITDB_ARGS=--data-checksums
|
|
- POSTGRES_DB=penpot
|
|
- POSTGRES_USER=penpot
|
|
# POSTGRES_PASSWORD provided via secrets/penpot.env
|
|
|
|
volumes:
|
|
- penpot_postgres_data:/var/lib/postgresql/data
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
penpot-redis:
|
|
image: redis:7
|
|
restart: always
|
|
networks:
|
|
- penpot
|