Andrew Phillips
e672ec751e
Add server-side JWT authentication with permission-based access control (read/write/delete claims). Password authentication now uses HTTP Basic auth only (replacing Bearer). Add configurable username for both server and client (--server-username/--client-username, defaults to "keep"). JWT secret supports file-based loading via --server-jwt-secret-file for Docker secrets. OPTIONS preflight requests bypass auth. HEAD mapped to read permission. Co-Authored-By: opencode <noreply@opencode.ai>
33 lines
838 B
YAML
33 lines
838 B
YAML
services:
|
|
keep:
|
|
build: .
|
|
ports:
|
|
- "21080:21080"
|
|
volumes:
|
|
- keep-data:/data
|
|
- keep-config:/config
|
|
environment:
|
|
- KEEP_SERVER_ADDRESS=0.0.0.0
|
|
- KEEP_SERVER_PORT=21080
|
|
# - KEEP_SERVER_USERNAME=keep
|
|
# - KEEP_SERVER_PASSWORD=changeme
|
|
# - KEEP_SERVER_PASSWORD_HASH=
|
|
# - KEEP_SERVER_JWT_SECRET=
|
|
# - KEEP_SERVER_JWT_SECRET_FILE=/config/jwt_secret
|
|
# - KEEP_COMPRESSION=lz4
|
|
# - KEEP_META_PLUGINS=
|
|
# - KEEP_FILTERS=
|
|
- KEEP_CONFIG=/config/config.yml
|
|
# - KEEP_SERVER_CERT=/certs/cert.pem
|
|
# - KEEP_SERVER_KEY=/certs/key.pem
|
|
# - KEEP_CLIENT_USERNAME=keep
|
|
# - KEEP_CLIENT_JWT=""
|
|
restart: unless-stopped
|
|
# For TLS, mount certificate files:
|
|
# volumes:
|
|
# - ./certs:/certs:ro
|
|
|
|
volumes:
|
|
keep-data:
|
|
keep-config:
|