personal-website/compose.host-networking.example.yml at main · calum4/personal-website · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# Host networking

services:
  personal-website:
    container_name: personal-website
    build:
      args:
        - SET_CAP_NET_BIND_SERVICE=true # Applies the NET_BIND_SERVICE capability to the Nginx binary (required)
    environment:
      NGINX_SERVER_NAME: "example.com"
      REALIP_SOURCE: "false" # `false`, `cloudflare`, `custom`
      REALIP_CUSTOM_FROM: "" # Ignored if REALIP_SOURCE not 'custom'. Comma-seperated list of realip sources, see https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
      REALIP_CUSTOM_HEADER: "" # Ignored if REALIP_SOURCE not 'custom'. See https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
      NGINX_HTTP_LISTEN_PORT: 80
      NGINX_HTTPS_LISTEN_PORT: 443
      NGINX_IPV4_LISTEN_ADDR: "0.0.0.0"
      NGINX_IPV6_LISTEN_ADDR: "[::]"
    network_mode: host
    volumes:
      - personal-website-ssl:/etc/ssl/personal-website/
      - default-server-ssl:/etc/ssl/default-server/
      - ./public/public/:/usr/share/personal-website/html/public/
    read_only: true
    tmpfs:
      - /tmp
    #security_opt:
    #  - no-new-privileges=true # Not possible when binding to privileged ports (<1024) on the host network
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE # Required to bind to privileged ports (<1024) on the host network
    logging:
      driver: local
    restart: unless-stopped

volumes:
  personal-website-ssl:
  default-server-ssl: