Oskar Kapala
fbf9e7501d
Nextcloud zostaje prywatny (mesh/kapala.org); Gokapi to osobny publiczny serwis do wysylania linkow do plikow na zewnatrz (Firefox Send alt). owner_node=vps, storage lokalny dysk (nie S3), E2E encryption ON, port 53842 bindowany tylko na TAILSCALE_BIND_IP (hairpin NAT przez npm@VPS, nigdy 0.0.0.0). Cutover checklist w README (DNS, wildcard *.okit.pl na npm@VPS, setup wizard) — nie zdeployowane w tym commicie. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
48 lines
2.6 KiB
Plaintext
48 lines
2.6 KiB
Plaintext
# Gokapi host-local binds + disk-protection tuning — copy to .env (gitignored)
|
|
# next to docker-compose.yml and fill in real values. Never commit .env.
|
|
# No auth secrets here: Gokapi has no headless admin env vars — the admin
|
|
# account is created in the one-time /setup web wizard (see README).
|
|
|
|
# Tailscale IP of the VPS node (ubuntu-4gb-hel1-1). Bind the gokapi port
|
|
# ONLY to this interface — never 0.0.0.0. The public internet never reaches
|
|
# port 53842 directly; share.okit.pl reaches gokapi only through npm@VPS
|
|
# (which runs on the same host and connects to this IP via Docker hairpin
|
|
# NAT — see docker-compose.yml). Verify when rebuilding the host:
|
|
# tailscale ip -4.
|
|
TAILSCALE_BIND_IP=100.95.58.48
|
|
|
|
TZ=Europe/Warsaw
|
|
|
|
# --- Disk protection -------------------------------------------------------
|
|
# VPS has an 80 GB disk shared with npm, outline, joplin, ai-cluster,
|
|
# fleet-prometheus's TSDB, etc. — gokapi is NOT the only tenant, and it has
|
|
# no S3 backend (local disk only, by design). Keep uploads small and leave
|
|
# headroom so expiring links actually reclaim space before the disk fills.
|
|
|
|
# Per-file upload cap in MB. 5120 = 5 GB. Upstream default is 102400
|
|
# (100 GB), which would let a single upload fill the whole disk.
|
|
GOKAPI_MAX_FILESIZE=5120
|
|
|
|
# Refuse new uploads once free disk space drops below this many MB. Upstream
|
|
# default is 400; raised here for the same reason as above.
|
|
GOKAPI_MIN_FREE_SPACE=2048
|
|
|
|
# npm@VPS and gokapi run on the same host; npm reaches gokapi's Tailscale-
|
|
# bound port via Docker hairpin NAT, so the connection arrives from the
|
|
# docker bridge gateway, not the real client IP. Trust that range so
|
|
# X-Forwarded-For / IP logging work correctly — same lesson as nextcloud's
|
|
# TRUSTED_PROXIES. Narrow to the exact /24 once the stack is up on the live
|
|
# host: docker network inspect gokapi_default.
|
|
GOKAPI_TRUSTED_PROXIES=172.16.0.0/12
|
|
|
|
# --- NOT env vars — Gokapi has no headless config for these. Set them in
|
|
# the one-time /setup wizard on first boot (see README Cutover checklist):
|
|
# - Admin username/password (Authentication step)
|
|
# - Storage backend: Local (Storage step — NOT S3,
|
|
# per Oskar's decision)
|
|
# - Encryption level: End-to-End (Level 3) (Encryption step —
|
|
# Oskar wants E2E ON)
|
|
# - Default expiry / max downloads: there is NO global default in Gokapi —
|
|
# it's chosen per-upload in the web form. Use conservative values (e.g.
|
|
# 7 days / 10 downloads) each time to keep the disk from filling.
|