Oskar Kapala
fbf9e7501d
Nextcloud zostaje prywatny (mesh/kapala.org); Gokapi to osobny publiczny serwis do wysylania linkow do plikow na zewnatrz (Firefox Send alt). owner_node=vps, storage lokalny dysk (nie S3), E2E encryption ON, port 53842 bindowany tylko na TAILSCALE_BIND_IP (hairpin NAT przez npm@VPS, nigdy 0.0.0.0). Cutover checklist w README (DNS, wildcard *.okit.pl na npm@VPS, setup wizard) — nie zdeployowane w tym commicie. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
44 lines
2.1 KiB
YAML
44 lines
2.1 KiB
YAML
# Gokapi — public file-share (Firefox Send-style), separate from Nextcloud.
|
|
#
|
|
# Nextcloud stays the private "twierdza" (mesh/kapala.org only). Gokapi is
|
|
# the OPPOSITE end of the spectrum on purpose: a small, single-container,
|
|
# genuinely public link-share for sending someone outside the mesh a file.
|
|
# Runs on VPS (Hetzner, public host) — home nodes stay untouched.
|
|
services:
|
|
gokapi:
|
|
# Pinned to the current stable release (v2.2.4, verified against
|
|
# github.com/Forceu/Gokapi releases + Docker Hub f0rc3/gokapi tags on
|
|
# 2026-07-09) — never :latest, so upgrades are a deliberate git diff,
|
|
# same convention as nextcloud.
|
|
image: f0rc3/gokapi:v2.2.4
|
|
container_name: gokapi
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
volumes:
|
|
# /opt/homelab/data convention. `data` holds uploaded files (churns
|
|
# constantly — links expire and get deleted); `config` holds
|
|
# config.json + the E2E encryption master key. See README backup note:
|
|
# config is the part that actually needs backing up.
|
|
- /opt/homelab/data/gokapi/data:/app/data
|
|
- /opt/homelab/data/gokapi/config:/app/config
|
|
ports:
|
|
# PUBLIC reachability is via npm@VPS + share.okit.pl, NOT this bind.
|
|
# Bound ONLY to the VPS Tailscale interface (TAILSCALE_BIND_IP), never
|
|
# 0.0.0.0 — same defense-in-depth convention as fleet-prometheus: the
|
|
# raw port does not exist on the public Hetzner IP (135.181.153.108)
|
|
# at all. npm, running as its own container on the same host, reaches
|
|
# gokapi via Docker hairpin NAT through this real interface IP
|
|
# (loopback would NOT work for that trick — see fleet-prometheus /
|
|
# nextcloud for the same pattern). Requires .env (from env.example)
|
|
# next to this file at deploy.
|
|
- "${TAILSCALE_BIND_IP}:53842:53842"
|
|
# Image ships curl (alpine-based), so an in-container check works here —
|
|
# unlike vikunja's image, which has neither curl nor wget.
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fs", "--max-time", "5", "http://127.0.0.1:53842/"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 15s
|