mirror of
https://github.com/bookorbit/bookorbit.git
synced 2026-11-03 00:11:37 -06:00
neon
b8ba579336
Podcasts shipped switched off in every release and are now removed from the server, web client and shared types. Migration 0132 drops the podcast tables and the media-type, library-type and folder-role columns. Released iOS and Android builds read the removed response fields as optional, so the API change stays compatible.
119 lines
5.4 KiB
Bash
119 lines
5.4 KiB
Bash
# Docker image to run. Pin a sha-* tag or @sha256 digest for stricter deploys.
|
|
APP_IMAGE=ghcr.io/bookorbit/bookorbit:latest
|
|
|
|
# App publish port on host
|
|
# For access only from this host (such as a host reverse proxy), use 127.0.0.1:3000.
|
|
APP_PORT=3000
|
|
|
|
# Optional listen address inside the container (IPv4 or IPv6, without brackets).
|
|
# Keep the default for bridge networking; use APP_PORT above to restrict host exposure.
|
|
# HOST=0.0.0.0
|
|
|
|
# Host folder that appears as /books in the container.
|
|
# Point this at your library root; use an absolute path on NAS/Portainer installs.
|
|
BOOKS_HOST_PATH=./books
|
|
|
|
# Container runtime UID/GID for files written to app-managed data folders.
|
|
# Most users can leave these defaults.
|
|
PUID=1000
|
|
PGID=1000
|
|
|
|
# Database credentials
|
|
POSTGRES_USER=bookorbit
|
|
POSTGRES_PASSWORD=change-this-password
|
|
POSTGRES_DB=bookorbit
|
|
|
|
# App secrets
|
|
JWT_SECRET=change-this-to-a-long-random-secret
|
|
# Required for the initial /auth/setup endpoint (x-setup-token header)
|
|
SETUP_BOOTSTRAP_TOKEN=change-this-to-a-long-random-secret
|
|
|
|
# Sensitive values can instead be read from mounted files by appending _FILE.
|
|
# Leave the direct value blank, then set its _FILE variable to the container path.
|
|
# Keep the blank assignment: docker-compose.yml requires these keys to be present.
|
|
# A non-empty direct value and its _FILE variable are mutually exclusive.
|
|
# The file must be mounted into every service that uses it, and must not be empty.
|
|
# POSTGRES_PASSWORD_FILE=/run/secrets/bookorbit_postgres_password
|
|
# JWT_SECRET_FILE=/run/secrets/bookorbit_jwt_secret
|
|
# SETUP_BOOTSTRAP_TOKEN_FILE=/run/secrets/bookorbit_setup_bootstrap_token
|
|
|
|
# External/public URL used by emails and Kobo endpoints
|
|
APP_URL=https://bookorbit.example.com
|
|
|
|
# Node.js JavaScript heap limit in MB. Raise this for very large libraries, 250K+ books.
|
|
NODE_MAX_OLD_SPACE_SIZE=2048
|
|
|
|
# Optional read-aloud generation. Enable the compose profile and use the same random token for
|
|
# BookOrbit and its private STAlign worker. The first job per language downloads a speech model
|
|
# (about 190 MB) into data/app/read-aloud. Generate the token with: openssl rand -hex 32
|
|
# COMPOSE_PROFILES=read-aloud
|
|
# READ_ALOUD_WORKER_URL=http://read-aloud-worker:8787
|
|
# READ_ALOUD_WORKER_TOKEN=
|
|
# READ_ALOUD_WORKER_IMAGE=ghcr.io/bookorbit/bookorbit-read-aloud-worker:latest
|
|
# READ_ALOUD_MAX_OUTPUT_BYTES=21474836480
|
|
# Folders the worker can read books from, comma-separated. Add a read-only mount for each extra
|
|
# library folder to the worker service as well.
|
|
# READ_ALOUD_LIBRARY_ROOTS=/books
|
|
# The worker image runs on CPU. A native worker on Apple Silicon uses MLX when this is auto; cuda is
|
|
# only for a native Linux worker with CUDA 12 and cuDNN 9, and is checked at startup.
|
|
# READ_ALOUD_CTC_DEVICE=auto
|
|
# READ_ALOUD_CTC_DTYPE=auto
|
|
# READ_ALOUD_CTC_BATCH_SIZE=
|
|
|
|
# --- Optional overrides (uncomment to set) ---
|
|
|
|
# If you already run your own PostgreSQL, set DATABASE_URL and remove the
|
|
# postgres service from docker-compose.yml. Your instance must have the
|
|
# uuid-ossp, pg_trgm, and vector (pgvector) extensions available.
|
|
# DATABASE_URL=postgres://user:password@yourhost:5432/bookorbit
|
|
# DATABASE_URL_FILE=/run/secrets/bookorbit_database_url
|
|
# Or set individual parts (POSTGRES_HOST, POSTGRES_PORT, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB)
|
|
|
|
# CORS origin for the frontend when served from a different domain than APP_URL
|
|
# CLIENT_URL=https://app.example.com
|
|
|
|
# Container folder used as the top of the library creation folder picker.
|
|
# Defaults to / when unset. Set to /books to hide other container root folders.
|
|
# LIBRARY_BROWSE_ROOT=/books
|
|
|
|
# Set to false only if your platform manages bind mount ownership externally.
|
|
# BOOKORBIT_FIX_PERMISSIONS=true
|
|
|
|
# Recommended if you store SMTP provider credentials (generate: openssl rand -hex 32)
|
|
# EMAIL_ENCRYPTION_KEY=
|
|
# EMAIL_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_email_encryption_key
|
|
|
|
# Recommended if you store migration source credentials (generate: openssl rand -hex 32)
|
|
# MIGRATION_ENCRYPTION_KEY=
|
|
# MIGRATION_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_migration_encryption_key
|
|
|
|
# Required before download-client or indexer credentials can be saved.
|
|
# BOOK_REQUEST_ENCRYPTION_KEY=
|
|
# BOOK_REQUEST_ENCRYPTION_KEY_FILE=/run/secrets/bookorbit_book_request_encryption_key
|
|
|
|
# Optional GitHub token used to read release notes, raising the anonymous API rate limit.
|
|
# GITHUB_RELEASES_TOKEN=
|
|
# GITHUB_RELEASES_TOKEN_FILE=/run/secrets/bookorbit_github_releases_token
|
|
|
|
# Absolute container path that authorizes local migration backup files.
|
|
# Mount a dedicated host directory at this path as read-only before enabling backup mode.
|
|
# MIGRATION_IMPORT_ROOT=/imports
|
|
|
|
# Log level (default: info). Set to debug for verbose output.
|
|
# LOG_LEVEL=info
|
|
|
|
# Allow OIDC issuer/discovery URLs that resolve to private/local addresses.
|
|
# Default false. Enable only in trusted self-hosted networks.
|
|
# OIDC_ALLOW_LOCAL_ISSUERS=false
|
|
# Trust additional PEM-encoded certificate authorities for outbound TLS, including OIDC.
|
|
# Mount the CA bundle read-only, set its in-container path here, and restart BookOrbit.
|
|
# NODE_EXTRA_CA_CERTS=/path/to/private-ca-bundle.pem
|
|
|
|
# Disable username/password sign-in after at least one active administrator has linked an enabled
|
|
# OIDC provider. Set false and restart to recover access if the identity provider is unavailable.
|
|
# DISABLE_LOCAL_AUTH=false
|
|
|
|
# Optional: allow Cloudflare Web Analytics beacon when using automatic setup.
|
|
# Keep unset/false to preserve strict CSP (`script-src 'self'`).
|
|
# CSP_ALLOW_CLOUDFLARE_INSIGHTS=false
|