Oskar Kapala
fbf9e7501d
Nextcloud zostaje prywatny (mesh/kapala.org); Gokapi to osobny publiczny serwis do wysylania linkow do plikow na zewnatrz (Firefox Send alt). owner_node=vps, storage lokalny dysk (nie S3), E2E encryption ON, port 53842 bindowany tylko na TAILSCALE_BIND_IP (hairpin NAT przez npm@VPS, nigdy 0.0.0.0). Cutover checklist w README (DNS, wildcard *.okit.pl na npm@VPS, setup wizard) — nie zdeployowane w tym commicie. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
35 lines
1.8 KiB
YAML
35 lines
1.8 KiB
YAML
service:
|
|
name: gokapi
|
|
owner_node: vps
|
|
role: public-file-share # Firefox Send-style link sharing, deliberately separate from Nextcloud
|
|
exposure: public # public via npm@VPS (share.okit.pl). The container's own port binds
|
|
# to TAILSCALE_BIND_IP only, never 0.0.0.0 — npm is the sole public
|
|
# entry point (see docker-compose.yml). Same pattern as vikunja.
|
|
dependencies: [] # standalone; npm@VPS proxies to it but gokapi has no upstream deps
|
|
ports:
|
|
- container: 53842
|
|
host: 53842
|
|
protocol: tcp
|
|
healthcheck:
|
|
type: http
|
|
endpoint: http://localhost:53842/ # setup wizard until first admin login, then the login page
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
restart_policy: unless-stopped
|
|
persistence:
|
|
paths:
|
|
- /opt/homelab/data/gokapi/data # uploaded files — ephemeral by design, links expire
|
|
- /opt/homelab/data/gokapi/config # config.json + E2E encryption master key — BACK THIS UP
|
|
runtime:
|
|
config_files:
|
|
- .env # host-local binds + disk-protection tuning (gitignored, from env.example)
|
|
env_vars:
|
|
- TAILSCALE_BIND_IP # required — mesh-only port bind; npm@VPS reaches it via hairpin NAT
|
|
- GOKAPI_MAX_FILESIZE # per-file cap in MB — keeps the shared VPS disk from filling
|
|
- GOKAPI_MIN_FREE_SPACE # MB headroom before uploads are refused
|
|
- GOKAPI_TRUSTED_PROXIES # npm@VPS as seen through Docker hairpin NAT (docker bridge subnet)
|
|
# No admin/auth env vars: Gokapi has no headless setup — admin account,
|
|
# storage backend, encryption level are all set in the /setup web
|
|
# wizard on first boot (deploy-time step, see README).
|