-
-
Save kimsible/7a613310c4686b066599b9232afabecc to your computer and use it in GitHub Desktop.
Docker-compose for a peertube production instance
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
PEERTUBE_DB_USERNAME=postgres_user | |
PEERTUBE_DB_PASSWORD=postgres_password | |
PEERTUBE_WEBSERVER_HOSTNAME=domain.tld | |
# If you need more than one IP as trust_proxy | |
# pass them as a comma separated array: | |
PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "172.18.0.0/16"] | |
#PEERTUBE_SMTP_USERNAME= | |
#PEERTUBE_SMTP_PASSWORD= | |
PEERTUBE_SMTP_HOSTNAME=postfix | |
PEERTUBE_SMTP_PORT=25 | |
PEERTUBE_SMTP_FROM=noreply@domain.tld | |
PEERTUBE_SMTP_TLS=false | |
PEERTUBE_SMTP_DISABLE_STARTTLS=false | |
PEERTUBE_ADMIN_EMAIL=admin@domain.com | |
PEERTUBE_DOCKER_IMAGE=chocobozzz/peertube:production-stretch | |
# /!\ Prefer to use the PeerTube admin interface to set the following configurations /!\ | |
#PEERTUBE_SIGNUP_ENABLED=true | |
#PEERTUBE_TRANSCODING_ENABLED=true | |
#PEERTUBE_CONTACT_FORM_ENABLED=true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
version: "3.3" | |
services: | |
reverse-proxy: | |
image: traefik:v2.1 | |
network_mode: "host" | |
command: | |
- --providers.docker # Tells Træfik to listen to docker | |
- --providers.docker.exposedByDefault=false # Don't expose containers by default through Traefik | |
- --entrypoints.web.address=:80 | |
- --entrypoints.web-secure.address=:443 | |
- --certificatesresolvers.cr.acme.httpchallenge=true | |
- --certificatesresolvers.cr.acme.httpchallenge.entrypoint=web | |
- --certificatesresolvers.cr.acme.email=${PEERTUBE_ADMIN_EMAIL} | |
- --certificatesresolvers.cr.acme.storage=/etc/traefik/acme.json | |
# If you want to test/debug uncomment the following lines | |
#- --log.level=DEBUG | |
#- --certificatesresolvers.cr.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory | |
ports: | |
- "80:80" # The HTTP port | |
- "443:443" # The HTTPS port | |
volumes: | |
- /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events | |
#- ./docker-volume/traefik:/etc/traefik | |
restart: "always" | |
# If you want to use the Traefik dashboard, you should expose it on a | |
# subdomain with HTTPS and authentification: | |
# https://medium.com/@xavier.priour/secure-traefik-dashboard-with-https-and-password-in-docker-5b657e2aa15f | |
# https://github.com/containous/traefik/issues/880#issuecomment-310301168 | |
peertube: | |
# If you don't want to use the official image and build one from sources | |
# build: | |
# context: . | |
# dockerfile: ./support/docker/production/Dockerfile.stretch | |
image: ${PEERTUBE_DOCKER_IMAGE} | |
env_file: | |
- .env | |
# Traefik labels are suggested as an example for people using Traefik, | |
# remove them if you are using another reverse proxy. | |
labels: | |
- traefik.enable=true | |
- traefik.http.routers.peertube.rule=Host(`${PEERTUBE_WEBSERVER_HOSTNAME}`) | |
- traefik.http.services.peertube.loadbalancer.server.port=9000 | |
- traefik.http.routers.peertube.entrypoints=web-secure | |
- traefik.http.routers.peertube.tls.certresolver=cr # Name certificate resolver | |
# Redirect http to https | |
- traefik.http.routers.peertube-insecure.rule=Host(`${PEERTUBE_WEBSERVER_HOSTNAME}`) | |
- traefik.http.routers.peertube-insecure.entrypoints=web | |
- traefik.http.routers.peertube-insecure.middlewares=https-only | |
- traefik.http.middlewares.https-only.redirectscheme.scheme=https # Apply middleware redirect | |
# If you don't want to use a reverse proxy (not suitable for production!) | |
# ports: | |
# - "80:9000" | |
volumes: | |
- ./docker-volume/data:/data | |
- ./docker-volume/config:/config | |
depends_on: | |
- postgres | |
- redis | |
- postfix | |
restart: "always" | |
postgres: | |
image: postgres:10-alpine | |
environment: | |
POSTGRES_USER: ${PEERTUBE_DB_USERNAME} | |
POSTGRES_PASSWORD: ${PEERTUBE_DB_PASSWORD} | |
POSTGRES_DB: peertube | |
volumes: | |
- ./docker-volume/db:/var/lib/postgresql/data | |
restart: "always" | |
redis: | |
image: redis:4-alpine | |
volumes: | |
- ./docker-volume/redis:/data | |
restart: "always" | |
postfix: | |
image: mwader/postfix-relay | |
environment: | |
- POSTFIX_myhostname=${PEERTUBE_WEBSERVER_HOSTNAME} | |
restart: "always" | |
networks: | |
default: | |
ipam: | |
driver: default | |
config: | |
- subnet: 172.18.0.0/16 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Here's the updated PEERTUBE_TRUST_PROXY
- PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "172.18.0.0/16", "10.0.0.0/16", "173.245.48.0/20", "103.21.244.0/22","103.22.200.0/22","103.31.4.0/22","141.101.64.0/18","108.162.192.0/18","190.93.240.0/20","188.114.96.0/20","197.234.240.0/22","198.41.128.0/17","162.158.0.0/15","104.16.0.0/13","104.24.0.0/14","172.64.0.0/13","131.0.72.0/22"]
The list of cloudflare ip ranges can be found at
https://www.cloudflare.com/en-gb/ips/