mirror of
https://github.com/bookorbit/bookorbit.git
synced 2026-11-03 00:11:37 -06:00
neon
419f634e5c
Allow self-hosted deployments to explicitly trust private/local OIDC issuer hosts while keeping production defaults locked down. Keep SSRF protections unchanged outside OIDC issuer and discovery validation paths. Closes #107
68 lines
2.7 KiB
Bash
68 lines
2.7 KiB
Bash
# Docker image to run. Pin a sha-* tag or @sha256 digest for stricter deploys.
|
|
APP_IMAGE=ghcr.io/bookorbit/bookorbit:latest
|
|
|
|
# App publish port on host
|
|
APP_PORT=3000
|
|
|
|
# Host folder that appears as /books in the container.
|
|
# Point this at your library root; use an absolute path on NAS/Portainer installs.
|
|
BOOKS_HOST_PATH=./books
|
|
|
|
# Optional: host folder for the Book Dock drop zone (maps to /data/book-dock inside the container).
|
|
# Copy or move ebook files here and they will be automatically picked up and processed by Book Dock.
|
|
# If not set, the drop folder lives inside ./data/app/book-dock (the default app data volume).
|
|
# Use an absolute path when mounting a NAS share or a folder managed outside the app data directory.
|
|
# BOOK_DROP_HOST_PATH=/mnt/nas/book-drop
|
|
|
|
# Container runtime UID/GID for files written to app-managed data folders.
|
|
# Most users can leave these defaults.
|
|
PUID=1000
|
|
PGID=1000
|
|
|
|
# Database credentials
|
|
POSTGRES_USER=bookorbit
|
|
POSTGRES_PASSWORD=change-this-password
|
|
POSTGRES_DB=bookorbit
|
|
|
|
# App secrets
|
|
JWT_SECRET=change-this-to-a-long-random-secret
|
|
# Required for the initial /auth/setup endpoint (x-setup-token header)
|
|
SETUP_BOOTSTRAP_TOKEN=change-this-to-a-long-random-secret
|
|
|
|
# External/public URL used by emails and Kobo endpoints
|
|
APP_URL=https://bookorbit.example.com
|
|
|
|
# Node.js JavaScript heap limit in MB. Raise this for very large libraries.
|
|
NODE_MAX_OLD_SPACE_SIZE=2048
|
|
|
|
# --- Optional overrides (uncomment to set) ---
|
|
|
|
# If you already run your own PostgreSQL, set DATABASE_URL and remove the
|
|
# postgres service from docker-compose.yml. Your instance must have the
|
|
# uuid-ossp, pg_trgm, and vector (pgvector) extensions available.
|
|
# DATABASE_URL=postgres://user:password@yourhost:5432/bookorbit
|
|
# Or set individual parts (POSTGRES_HOST, POSTGRES_PORT, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB)
|
|
|
|
# CORS origin for the frontend when served from a different domain than APP_URL
|
|
# CLIENT_URL=https://app.example.com
|
|
|
|
# Set to false only if your platform manages bind mount ownership externally.
|
|
# BOOKORBIT_FIX_PERMISSIONS=true
|
|
|
|
# Recommended if you store SMTP provider credentials (generate: openssl rand -hex 32)
|
|
# EMAIL_ENCRYPTION_KEY=
|
|
|
|
# Recommended if you store migration source credentials (generate: openssl rand -hex 32)
|
|
# MIGRATION_ENCRYPTION_KEY=
|
|
|
|
# Log level (default: info). Set to debug for verbose output.
|
|
# LOG_LEVEL=info
|
|
|
|
# Allow OIDC issuer/discovery URLs that resolve to private/local addresses.
|
|
# Default false. Enable only in trusted self-hosted networks.
|
|
# OIDC_ALLOW_LOCAL_ISSUERS=false
|
|
|
|
# Optional: allow Cloudflare Web Analytics beacon when using automatic setup.
|
|
# Keep unset/false to preserve strict CSP (`script-src 'self'`).
|
|
# CSP_ALLOW_CLOUDFLARE_INSIGHTS=false
|