mirror of
https://github.com/Dispatcharr/Dispatcharr.git
synced 2026-07-30 05:20:12 +00:00
955a16da62
This commit introduces a mechanism to restrict the first-time web setup of superusers to local/private networks by default. A new environment variable, DISPATCHARR_SETUP_ALLOWED_IP, allows specific public IPs to bypass this restriction. The changes include updates to the API views for handling setup requests, utility functions for IP validation, and enhancements to the frontend to inform users about setup restrictions. Additionally, tests have been added to ensure correct behavior under various scenarios, including IP validation and environment variable overrides.
237 lines
8.8 KiB
YAML
237 lines
8.8 KiB
YAML
# Dispatcharr - Modular Deployment Configuration
|
|
# This compose file runs Dispatcharr in modular mode with separate containers
|
|
# for web, celery workers, PostgreSQL database, and Redis cache.
|
|
|
|
services:
|
|
# ============================================================================
|
|
# Web Service
|
|
# ============================================================================
|
|
web:
|
|
image: ghcr.io/dispatcharr/dispatcharr:latest
|
|
container_name: dispatcharr_web
|
|
restart: unless-stopped
|
|
ports:
|
|
- 9191:9191
|
|
volumes:
|
|
- ./data:/data
|
|
#- ./certs:/certs:ro # TLS certificates (optional)
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
|
|
# --- Environment Configuration ---
|
|
environment:
|
|
# Deployment Mode
|
|
- DISPATCHARR_ENV=modular
|
|
|
|
# PostgreSQL Connection
|
|
- POSTGRES_HOST=db
|
|
- POSTGRES_PORT=5432
|
|
- POSTGRES_DB=dispatcharr
|
|
- POSTGRES_USER=dispatch
|
|
- POSTGRES_PASSWORD=secret
|
|
# PostgreSQL TLS (optional) — mount certs via the volume above
|
|
#- POSTGRES_SSL=true # required to enable TLS
|
|
#- POSTGRES_SSL_MODE=verify-full # optional: verify-full (default) | verify-ca | require
|
|
#- POSTGRES_SSL_CA_CERT=/certs/postgres/ca.crt # optional: CA cert to verify the server
|
|
#- POSTGRES_SSL_CERT=/certs/postgres/client.crt # optional: client cert (only if server requires client auth)
|
|
#- POSTGRES_SSL_KEY=/certs/postgres/client.key # optional: client key (only if server requires client auth)
|
|
|
|
# Redis Connection
|
|
- REDIS_HOST=redis
|
|
- REDIS_PORT=6379
|
|
# Redis Authentication (Optional)
|
|
# Uncomment and set if your Redis requires authentication:
|
|
#- REDIS_PASSWORD=your_strong_redis_password
|
|
#- REDIS_USER=your_redis_username # For Redis 6+ ACL - see Redis service below
|
|
# Redis TLS (optional) — mount certs via the volume above
|
|
#- REDIS_SSL=true # required to enable TLS
|
|
#- REDIS_SSL_VERIFY=true # optional: set false for self-signed certs without a CA
|
|
#- REDIS_SSL_CA_CERT=/certs/redis/ca.crt # optional: CA cert to verify the server
|
|
#- REDIS_SSL_CERT=/certs/redis/client.crt # optional: client cert (only if server requires client auth)
|
|
#- REDIS_SSL_KEY=/certs/redis/client.key # optional: client key (only if server requires client auth)
|
|
|
|
# Logging
|
|
- DISPATCHARR_LOG_LEVEL=info
|
|
|
|
# First-time web setup from a public IP (optional). When unset, only
|
|
# local/private networks may POST to initialize-superuser.
|
|
#- DISPATCHARR_SETUP_ALLOWED_IP=203.0.113.50
|
|
|
|
# Legacy CPU Support (Optional)
|
|
# Uncomment to enable legacy NumPy build for older CPUs (circa 2009)
|
|
# that lack support for newer baseline CPU features:
|
|
#- USE_LEGACY_NUMPY=true
|
|
|
|
# Process Priority Configuration (Optional)
|
|
# Lower values = higher priority. Range: -20 (highest) to 19 (lowest)
|
|
# Negative values require cap_add: SYS_NICE (see below)
|
|
#- UWSGI_NICE_LEVEL=-5 # uWSGI/FFmpeg/Streaming (default: 0, recommended: -5 for high priority)
|
|
|
|
# --- Advanced Configuration ---
|
|
# Uncomment to enable high priority for streaming (required if UWSGI_NICE_LEVEL < 0)
|
|
#cap_add:
|
|
# - SYS_NICE
|
|
|
|
# --- Hardware Acceleration (Optional) ---
|
|
# Uncomment for GPU access (transcoding acceleration)
|
|
#group_add:
|
|
# - video
|
|
# #- render # Uncomment if your GPU requires it
|
|
#devices:
|
|
# - /dev/dri:/dev/dri # For Intel/AMD GPU acceleration (VA-API)
|
|
|
|
# NVIDIA GPU Support (requires NVIDIA Container Toolkit)
|
|
# Uncomment the following lines for NVIDIA GPU support
|
|
#deploy:
|
|
# resources:
|
|
# reservations:
|
|
# devices:
|
|
# - driver: nvidia
|
|
# count: all
|
|
# capabilities: [gpu]
|
|
|
|
# ============================================================================
|
|
# Celery Service - Background task worker
|
|
# ============================================================================
|
|
celery:
|
|
image: ghcr.io/dispatcharr/dispatcharr:latest
|
|
container_name: dispatcharr_celery
|
|
restart: unless-stopped
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
web:
|
|
condition: service_started
|
|
volumes:
|
|
- ./data:/data
|
|
#- ./certs:/certs:ro # TLS certificates (optional)
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
entrypoint: ["/app/docker/entrypoint.celery.sh"]
|
|
|
|
# --- Environment Configuration ---
|
|
environment:
|
|
# Deployment Mode
|
|
- DISPATCHARR_ENV=modular
|
|
|
|
# Internal Service Communication
|
|
# Celery uses these to reach the web container for DVR recording.
|
|
# DISPATCHARR_PORT must match the port exposed by the web service.
|
|
# DISPATCHARR_WEB_HOST defaults to "web" (the service name above).
|
|
# Only set DISPATCHARR_WEB_HOST if you rename the web service in this file.
|
|
- DISPATCHARR_PORT=9191
|
|
#- DISPATCHARR_WEB_HOST=web
|
|
|
|
# PostgreSQL — must match web service settings
|
|
- POSTGRES_HOST=db
|
|
- POSTGRES_PORT=5432
|
|
- POSTGRES_DB=dispatcharr
|
|
- POSTGRES_USER=dispatch
|
|
- POSTGRES_PASSWORD=secret
|
|
# PostgreSQL TLS — must match web service
|
|
#- POSTGRES_SSL=true
|
|
#- POSTGRES_SSL_MODE=verify-full
|
|
#- POSTGRES_SSL_CA_CERT=/certs/postgres/ca.crt
|
|
#- POSTGRES_SSL_CERT=/certs/postgres/client.crt
|
|
#- POSTGRES_SSL_KEY=/certs/postgres/client.key
|
|
|
|
# Redis — must match web service settings
|
|
- REDIS_HOST=redis
|
|
- REDIS_PORT=6379
|
|
#- REDIS_PASSWORD=your_strong_redis_password
|
|
#- REDIS_USER=your_redis_username
|
|
# Redis TLS — must match web service
|
|
#- REDIS_SSL=true
|
|
#- REDIS_SSL_VERIFY=true
|
|
#- REDIS_SSL_CA_CERT=/certs/redis/ca.crt
|
|
#- REDIS_SSL_CERT=/certs/redis/client.crt
|
|
#- REDIS_SSL_KEY=/certs/redis/client.key
|
|
|
|
# Logging
|
|
- DISPATCHARR_LOG_LEVEL=info
|
|
|
|
# Process Priority Configuration (Optional)
|
|
#- CELERY_NICE_LEVEL=5 # Celery/EPG/Background tasks (default: 5, low priority; Range: -20 to 19)
|
|
|
|
# Legacy CPU Support (Optional)
|
|
# Uncomment to enable legacy NumPy build for older CPUs (circa 2009)
|
|
# that lack support for newer baseline CPU features:
|
|
#- USE_LEGACY_NUMPY=true
|
|
|
|
# Django Configuration
|
|
- DJANGO_SETTINGS_MODULE=dispatcharr.settings
|
|
- PYTHONUNBUFFERED=1
|
|
|
|
# --- Advanced Configuration ---
|
|
# Uncomment to enable high priority for Celery (required if CELERY_NICE_LEVEL < 0)
|
|
#cap_add:
|
|
# - SYS_NICE
|
|
|
|
# ============================================================================
|
|
# PostgreSQL
|
|
# ============================================================================
|
|
db:
|
|
image: postgres:17
|
|
container_name: dispatcharr_db
|
|
restart: unless-stopped
|
|
ports:
|
|
- "5436:5432"
|
|
environment:
|
|
- POSTGRES_DB=dispatcharr
|
|
- POSTGRES_USER=dispatch
|
|
- POSTGRES_PASSWORD=secret
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U dispatch -d dispatcharr"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ============================================================================
|
|
# Redis
|
|
# ============================================================================
|
|
redis:
|
|
image: redis:latest
|
|
container_name: dispatcharr_redis
|
|
restart: unless-stopped
|
|
|
|
# --- Authentication Configuration (Optional) ---
|
|
# By default, Redis runs without authentication.
|
|
# Choose ONE of the following options if authentication is required:
|
|
|
|
# Option 1: Password-only authentication (Redis <6 or default user)
|
|
#command: ["redis-server", "--requirepass", "your_strong_redis_password"]
|
|
|
|
# Option 2: Redis 6+ ACL with username + password (requires custom config file - see Redis documentation for configuration)
|
|
#command: ["redis-server", "/etc/redis/redis.conf"]
|
|
#volumes:
|
|
# - ./redis.conf:/etc/redis/redis.conf:ro
|
|
|
|
# --- Health Check Configuration ---
|
|
healthcheck:
|
|
# Default: No authentication
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
|
|
# If using Option 1 (password-only), uncomment this instead:
|
|
#test: ["CMD", "redis-cli", "-a", "your_strong_redis_password", "ping"]
|
|
|
|
# If using Option 2 (Redis 6+ ACL), uncomment this instead:
|
|
#test: ["CMD", "redis-cli", "--user", "your_redis_username", "-a", "your_strong_redis_password", "ping"]
|
|
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ==============================================================================
|
|
# Volumes
|
|
# ==============================================================================
|
|
volumes:
|
|
postgres_data:
|