Claude
2ae64420d9
DEPLOY.md: dedicated user with rootless Docker, deploy key, nginx + HTTPS, updates, backups. The container port is only published on 127.0.0.1 so nginx is the only way in (Docker would otherwise bypass the firewall). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HJhXuLD2Z6hv3Wqeq9UL9K
20 lines
869 B
YAML
20 lines
869 B
YAML
services:
|
|
awcc:
|
|
build: .
|
|
restart: unless-stopped
|
|
ports:
|
|
# Only reachable from the server itself; the reverse proxy (nginx) is the public entrance.
|
|
# Docker bypasses firewall rules for published ports, so never publish this on 0.0.0.0.
|
|
- "127.0.0.1:8080:8000"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
environment:
|
|
# Code that new users must enter to create an account (set it in the .env file next to this file).
|
|
# Empty = registration is disabled.
|
|
AW_REGISTRATION_CODE: ${AW_REGISTRATION_CODE:-}
|
|
# Set to 1 when a reverse proxy (nginx, Caddy, Traefik) in front sets X-Forwarded-* headers.
|
|
AW_TRUST_PROXY: ${AW_TRUST_PROXY:-0}
|
|
volumes:
|
|
- ./db:/db # SQLite database (users, characters, presets)
|
|
- ./backend/data:/app/data:ro # rules.json: edit, reload the page, done
|