Jannis Braun
531b496618
Make Backspace self-hostable in any homelab environment, not just a clean host
that owns ports 80/443.
install.sh is now mode-aware and auto-detects which fits:
- allinone (default): bundled Caddy + auto-HTTPS — unchanged behavior
- proxy: behind your own reverse proxy (nginx / Traefik / Caddy / Nginx Proxy
Manager / SWAG) — app published on 127.0.0.1:APP_PORT, no bundled Caddy,
prints paste-ready proxy snippets
- tunnel: behind a tunnel (Cloudflare / Tailscale) — same, plus a 90MB upload
cap (under Cloudflare's 100MB body limit) and voice force-disabled (WebRTC
over UDP can't traverse a tunnel)
Port detection is Docker-aware (consults `docker ps` published ports, not just
`ss`), so a host whose proxy already owns 80/443 via iptables DNAT — with no
listening socket for `ss` to see — is correctly detected as "taken" instead of
dead-ending.
docker-compose.proxy.yml is a small overlay, layered via COMPOSE_FILE (written
into .env so no `-f` flags are ever needed), that publishes the loopback port and
parks Caddy in an inert profile. The base compose file is untouched, so All-in-One
behaves exactly as before.
Prebuilt image: .github/workflows/docker-publish.yml builds and pushes a
multi-arch (linux/amd64 + linux/arm64) image to ghcr.io/thezwiss/backspace on
release tags (and manual dispatch), so weak/ARM hosts skip the ~1.6GB local build
(the Vite build OOMs small ARM boxes). install.sh and docker-compose.yml default
to pulling it, fall back to an image already present on the host, and finally to a
from-source build — AGPL §13 commit stamping preserved on every path. Kept
deliberately separate from the desktop-installer workflow (release.yml).
Docs: README gains a "Deployment modes" section (all three modes, nginx / Caddy /
Traefik snippets, GUI-proxy field-by-field, cloudflared ingress, the update path,
and voice-per-mode caveats); docs/systems/deployment.md updated to match.
Verified live on a throwaway VM: proxy + all-in-one end-to-end through install.sh
(with a real Let's Encrypt cert), tunnel config generation, loopback-only binding,
and the local-image fallback path.
95 lines
3.6 KiB
YAML
95 lines
3.6 KiB
YAML
# ============================================================
|
|
# Backspace — All-in-one production deployment
|
|
# ============================================================
|
|
# Run ./install.sh for first-time setup, or configure manually:
|
|
# 1. Copy .env.example to .env and fill in values
|
|
# 2. Generate livekit.yaml (if enabling voice)
|
|
# 3. docker compose up -d --build
|
|
# ============================================================
|
|
|
|
services:
|
|
# ── Backspace application server ──────────────────────────
|
|
backspace:
|
|
# Prebuilt multi-arch image on GHCR (published by .github/workflows/
|
|
# docker-publish.yml). `docker compose pull` / install.sh's default path
|
|
# fetches this so weak/ARM hosts skip the heavy local build. Both `image:`
|
|
# and `build:` are declared: if the image isn't present locally and can't be
|
|
# pulled, `docker compose up --build` (install.sh's fallback, and deploy.sh)
|
|
# builds from source instead and tags the result under this same ref.
|
|
# Override the tag with BACKSPACE_IMAGE_TAG in .env (defaults to `latest`).
|
|
image: ${BACKSPACE_IMAGE:-ghcr.io/thezwiss/backspace}:${BACKSPACE_IMAGE_TAG:-latest}
|
|
build:
|
|
context: .
|
|
args:
|
|
# AGPL-3.0 § 13: bake the running build's git commit into the image so
|
|
# /api/instance/info advertises the exact version. deploy.sh exports
|
|
# BACKSPACE_COMMIT before `docker compose build`; empty when unset.
|
|
BACKSPACE_COMMIT: ${BACKSPACE_COMMIT:-}
|
|
container_name: backspace
|
|
restart: unless-stopped
|
|
volumes:
|
|
- ./data:/app/data
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- NODE_ENV=production
|
|
- DB_PATH=/app/data/backspace.db
|
|
- UPLOAD_DIR=/app/data/uploads
|
|
# Fail fast with a clear message if the secret is missing/empty, instead of
|
|
# letting the container boot-crash on every `restart: unless-stopped` cycle
|
|
# (a silent loop that only shows up in `docker compose logs backspace`).
|
|
# install.sh generates this before bringing the stack up; this guard only
|
|
# bites the manual `cp .env.example .env && docker compose up` path.
|
|
- "JWT_SECRET=${JWT_SECRET:?Set JWT_SECRET in .env - generate one with: openssl rand -hex 32}"
|
|
networks:
|
|
- internal
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://localhost:' + (process.env.PORT || 3000) + '/api/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
|
|
# ── Caddy reverse proxy (auto-HTTPS) ─────────────────────
|
|
caddy:
|
|
image: caddy:2.11.1-alpine
|
|
container_name: caddy
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
environment:
|
|
- DOMAIN=${DOMAIN:?Set DOMAIN in .env}
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy-data:/data
|
|
- caddy-config:/config
|
|
networks:
|
|
- internal
|
|
depends_on:
|
|
backspace:
|
|
condition: service_healthy
|
|
|
|
# ── LiveKit voice/video server ────────────────────────────
|
|
# Activated by COMPOSE_PROFILES=voice in .env
|
|
livekit:
|
|
image: livekit/livekit-server:v1.9.11
|
|
container_name: livekit
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
volumes:
|
|
- ./livekit.yaml:/etc/livekit.yaml:ro
|
|
command: --config /etc/livekit.yaml
|
|
profiles:
|
|
- voice
|
|
|
|
networks:
|
|
internal:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
caddy-data:
|
|
caddy-config:
|