viewdoc/docker-compose.yml at master · dockette/viewdoc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
x-kasm: &kasm
  image: dockette/viewdoc:viewer-kasm
  shm_size: "512m"
  environment:
    # VNC_PW seeds ~/.kasmpasswd (the entrypoint requires the file exists);
    # VNCOPTIONS=-disableBasicAuth tells KasmVNC to skip the basic-auth
    # challenge so the iframe loads without a browser prompt. KasmVNC has
    # no kasmvnc.yaml toggle for this and no ?password= URL mechanism — the
    # CLI flag is the only supported path.
    VNC_PW: "viewdoc"
    VNCOPTIONS: "-disableBasicAuth"
    # Skip Kasm's smartcard bridge: viewdoc never forwards a reader, and the
    # bridge otherwise logs "bridge->relay: timeout" every ~7.5s.
    KASM_SVC_SMARTCARD: "0"
  networks: [viewdoc]
  restart: unless-stopped

x-webtop: &webtop
  image: dockette/viewdoc:viewer-webtop
  shm_size: "512m"
  environment:
    PUID: "1000"
    PGID: "1000"
    TZ: "Etc/UTC"
  networks: [viewdoc]
  restart: unless-stopped

services:
  control-center:
    build:
      context: .
      dockerfile: Dockerfile
      args: &version
        VERSION: ${VIEWDOC_VERSION:-dev}
    image: dockette/viewdoc:control-center
    environment:
      # Kasm runs KasmVNC on :6901 (https, self-signed; proxy skips verify).
      # Webtop runs nginx + kclient on :3000 (plain http). Webtop's kclient
      # requires a secure context (HTTPS or localhost) — the proxy patches
      # the JS at response time to bypass the check (see internal/proxy/proxy.go).
      VIEWER_SLOTS: "kasm://viewer-kasm-1,kasm://viewer-kasm-2,webtop://viewer-webtop-1,webtop://viewer-webtop-2"
      TLS_ADDR: ":8443"
      # TLS cert source (README → TLS certificate). Default: the pre-generated
      # self-signed cert embedded in the image.
      #   On-demand, kept in the certs volume across restarts:
      #     TLS_CERT: "generate"
      #     TLS_CERT_DIR: "/certs"
      #     TLS_HOSTS: "viewdoc.lan,192.168.1.10"
      #   Your own cert (mount it, e.g. ./tls:/tls:ro):
      #     TLS_CERT: "file"
      #     TLS_CERT_FILE: "/tls/fullchain.pem"
      #     TLS_KEY_FILE: "/tls/privkey.pem"
    volumes:
      - certs:/certs
    ports:
      - "8080:8080"
      - "8443:8443"
      # No per-slot ports — slots are mounted same-origin at /slot/{i}/ on
      # the main listener, which is what makes iframe audio work.
    depends_on:
      - viewer-kasm-1
      - viewer-kasm-2
      - viewer-webtop-1
      - viewer-webtop-2
    networks: [viewdoc]
    restart: unless-stopped

  # Each viewer image is built once, by its first replica; the second reuses
  # it (pull_policy: never keeps compose from fetching the published tag from
  # Docker Hub in its place). Shared settings live in x-kasm / x-webtop.
  viewer-kasm-1:
    <<: *kasm
    build:
      context: .
      dockerfile: .docker/kasm/Dockerfile
      args: *version

  viewer-kasm-2:
    <<: *kasm
    pull_policy: never

  viewer-webtop-1:
    <<: *webtop
    build:
      context: .
      dockerfile: .docker/webtop/Dockerfile
      args: *version

  viewer-webtop-2:
    <<: *webtop
    pull_policy: never

networks:
  viewdoc:

volumes:
  certs: