mirror of
https://github.com/Dispatcharr/Dispatcharr.git
synced 2026-07-17 16:50:53 +00:00
b30a24e2fb
- Add 10 env vars for Redis/PostgreSQL TLS (REDIS_SSL, REDIS_SSL_VERIFY, REDIS_SSL_CA_CERT, REDIS_SSL_CERT, REDIS_SSL_KEY, POSTGRES_SSL, POSTGRES_SSL_MODE, POSTGRES_SSL_CA_CERT, POSTGRES_SSL_CERT, POSTGRES_SSL_KEY) - Propagate SSL params to all Redis connection points: RedisClient, stream view, PubSub, client manager, Celery broker/result backend, Django Channels, and pre-Django startup scripts - Add Celery SSL config via URL query string params (required by Kombu's internal URL parsing) - Add PostgreSQL sslmode and certificate options to DATABASES config - Add startup validation: cert file existence, URL scheme conflict detection, TLS status logging - Add TLS error hints to Redis connection failure messages - Add Connection Security panel in System Settings (modular mode only) showing encryption, verification, and mTLS status - Add PG client key permission fix in web and celery entrypoints for Docker Desktop compatibility (0777 to 0600) - Add TLS env var passthrough in entrypoint for su - login shells - Document TLS env vars in modular docker-compose.yml - Change env_mode from dev/prod to actual DISPATCHARR_ENV value for modular mode detection
229 lines
8.4 KiB
YAML
229 lines
8.4 KiB
YAML
# Dispatcharr - Modular Deployment Configuration
|
|
# This compose file runs Dispatcharr in modular mode with separate containers
|
|
# for web, celery workers, PostgreSQL database, and Redis cache.
|
|
|
|
services:
|
|
# ============================================================================
|
|
# Web Service
|
|
# ============================================================================
|
|
web:
|
|
image: ghcr.io/dispatcharr/dispatcharr:latest
|
|
container_name: dispatcharr_web
|
|
restart: unless-stopped
|
|
ports:
|
|
- 9191:9191
|
|
volumes:
|
|
- ./data:/data
|
|
#- ./certs:/certs:ro # TLS certificates (optional)
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
|
|
# --- Environment Configuration ---
|
|
environment:
|
|
# Deployment Mode
|
|
- DISPATCHARR_ENV=modular
|
|
|
|
# PostgreSQL Connection
|
|
- POSTGRES_HOST=db
|
|
- POSTGRES_PORT=5432
|
|
- POSTGRES_DB=dispatcharr
|
|
- POSTGRES_USER=dispatch
|
|
- POSTGRES_PASSWORD=secret
|
|
# PostgreSQL TLS (optional) — mount certs via the volume above
|
|
#- POSTGRES_SSL=true # required to enable TLS
|
|
#- POSTGRES_SSL_MODE=verify-full # optional: verify-full (default) | verify-ca | require
|
|
#- POSTGRES_SSL_CA_CERT=/certs/postgres/ca.crt # optional: CA cert to verify the server
|
|
#- POSTGRES_SSL_CERT=/certs/postgres/client.crt # optional: client cert (only if server requires client auth)
|
|
#- POSTGRES_SSL_KEY=/certs/postgres/client.key # optional: client key (only if server requires client auth)
|
|
|
|
# Redis Connection
|
|
- REDIS_HOST=redis
|
|
- REDIS_PORT=6379
|
|
# Redis Authentication (Optional)
|
|
# Uncomment and set if your Redis requires authentication:
|
|
#- REDIS_PASSWORD=your_strong_redis_password
|
|
#- REDIS_USER=your_redis_username # For Redis 6+ ACL - see Redis service below
|
|
# Redis TLS (optional) — mount certs via the volume above
|
|
#- REDIS_SSL=true # required to enable TLS
|
|
#- REDIS_SSL_VERIFY=true # optional: set false for self-signed certs without a CA
|
|
#- REDIS_SSL_CA_CERT=/certs/redis/ca.crt # optional: CA cert to verify the server
|
|
#- REDIS_SSL_CERT=/certs/redis/client.crt # optional: client cert (only if server requires client auth)
|
|
#- REDIS_SSL_KEY=/certs/redis/client.key # optional: client key (only if server requires client auth)
|
|
|
|
# Logging
|
|
- DISPATCHARR_LOG_LEVEL=info
|
|
|
|
# Legacy CPU Support (Optional)
|
|
# Uncomment to enable legacy NumPy build for older CPUs (circa 2009)
|
|
# that lack support for newer baseline CPU features:
|
|
#- USE_LEGACY_NUMPY=true
|
|
|
|
# Process Priority Configuration (Optional)
|
|
# Lower values = higher priority. Range: -20 (highest) to 19 (lowest)
|
|
# Negative values require cap_add: SYS_NICE (see below)
|
|
#- UWSGI_NICE_LEVEL=-5 # uWSGI/FFmpeg/Streaming (default: 0, recommended: -5 for high priority)
|
|
|
|
# --- Advanced Configuration ---
|
|
# Uncomment to enable high priority for streaming (required if UWSGI_NICE_LEVEL < 0)
|
|
#cap_add:
|
|
# - SYS_NICE
|
|
|
|
# --- Hardware Acceleration (Optional) ---
|
|
# Uncomment for GPU access (transcoding acceleration)
|
|
#group_add:
|
|
# - video
|
|
# #- render # Uncomment if your GPU requires it
|
|
#devices:
|
|
# - /dev/dri:/dev/dri # For Intel/AMD GPU acceleration (VA-API)
|
|
|
|
# NVIDIA GPU Support (requires NVIDIA Container Toolkit)
|
|
# Uncomment the following lines for NVIDIA GPU support
|
|
#deploy:
|
|
# resources:
|
|
# reservations:
|
|
# devices:
|
|
# - driver: nvidia
|
|
# count: all
|
|
# capabilities: [gpu]
|
|
|
|
# ============================================================================
|
|
# Celery Service - Background task worker
|
|
# ============================================================================
|
|
celery:
|
|
image: ghcr.io/dispatcharr/dispatcharr:latest
|
|
container_name: dispatcharr_celery
|
|
restart: unless-stopped
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
web:
|
|
condition: service_started
|
|
volumes:
|
|
- ./data:/data
|
|
#- ./certs:/certs:ro # TLS certificates (optional)
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
entrypoint: ["/app/docker/entrypoint.celery.sh"]
|
|
|
|
# --- Environment Configuration ---
|
|
environment:
|
|
# Deployment Mode
|
|
- DISPATCHARR_ENV=modular
|
|
|
|
# Internal Service Communication
|
|
# Must match the web service port for DVR recording and internal API calls
|
|
- DISPATCHARR_PORT=9191
|
|
|
|
# PostgreSQL — must match web service settings
|
|
- POSTGRES_HOST=db
|
|
- POSTGRES_PORT=5432
|
|
- POSTGRES_DB=dispatcharr
|
|
- POSTGRES_USER=dispatch
|
|
- POSTGRES_PASSWORD=secret
|
|
# PostgreSQL TLS — must match web service
|
|
#- POSTGRES_SSL=true
|
|
#- POSTGRES_SSL_MODE=verify-full
|
|
#- POSTGRES_SSL_CA_CERT=/certs/postgres/ca.crt
|
|
#- POSTGRES_SSL_CERT=/certs/postgres/client.crt
|
|
#- POSTGRES_SSL_KEY=/certs/postgres/client.key
|
|
|
|
# Redis — must match web service settings
|
|
- REDIS_HOST=redis
|
|
- REDIS_PORT=6379
|
|
#- REDIS_PASSWORD=your_strong_redis_password
|
|
#- REDIS_USER=your_redis_username
|
|
# Redis TLS — must match web service
|
|
#- REDIS_SSL=true
|
|
#- REDIS_SSL_VERIFY=true
|
|
#- REDIS_SSL_CA_CERT=/certs/redis/ca.crt
|
|
#- REDIS_SSL_CERT=/certs/redis/client.crt
|
|
#- REDIS_SSL_KEY=/certs/redis/client.key
|
|
|
|
# Logging
|
|
- DISPATCHARR_LOG_LEVEL=info
|
|
|
|
# Process Priority Configuration (Optional)
|
|
#- CELERY_NICE_LEVEL=5 # Celery/EPG/Background tasks (default: 5, low priority; Range: -20 to 19)
|
|
|
|
# Legacy CPU Support (Optional)
|
|
# Uncomment to enable legacy NumPy build for older CPUs (circa 2009)
|
|
# that lack support for newer baseline CPU features:
|
|
#- USE_LEGACY_NUMPY=true
|
|
|
|
# Django Configuration
|
|
- DJANGO_SETTINGS_MODULE=dispatcharr.settings
|
|
- PYTHONUNBUFFERED=1
|
|
|
|
# --- Advanced Configuration ---
|
|
# Uncomment to enable high priority for Celery (required if CELERY_NICE_LEVEL < 0)
|
|
#cap_add:
|
|
# - SYS_NICE
|
|
|
|
# ============================================================================
|
|
# PostgreSQL
|
|
# ============================================================================
|
|
db:
|
|
image: postgres:17
|
|
container_name: dispatcharr_db
|
|
restart: unless-stopped
|
|
ports:
|
|
- "5436:5432"
|
|
environment:
|
|
- POSTGRES_DB=dispatcharr
|
|
- POSTGRES_USER=dispatch
|
|
- POSTGRES_PASSWORD=secret
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U dispatch -d dispatcharr"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ============================================================================
|
|
# Redis
|
|
# ============================================================================
|
|
redis:
|
|
image: redis:latest
|
|
container_name: dispatcharr_redis
|
|
restart: unless-stopped
|
|
|
|
# --- Authentication Configuration (Optional) ---
|
|
# By default, Redis runs without authentication.
|
|
# Choose ONE of the following options if authentication is required:
|
|
|
|
# Option 1: Password-only authentication (Redis <6 or default user)
|
|
#command: ["redis-server", "--requirepass", "your_strong_redis_password"]
|
|
|
|
# Option 2: Redis 6+ ACL with username + password (requires custom config file - see Redis documentation for configuration)
|
|
#command: ["redis-server", "/etc/redis/redis.conf"]
|
|
#volumes:
|
|
# - ./redis.conf:/etc/redis/redis.conf:ro
|
|
|
|
# --- Health Check Configuration ---
|
|
healthcheck:
|
|
# Default: No authentication
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
|
|
# If using Option 1 (password-only), uncomment this instead:
|
|
#test: ["CMD", "redis-cli", "-a", "your_strong_redis_password", "ping"]
|
|
|
|
# If using Option 2 (Redis 6+ ACL), uncomment this instead:
|
|
#test: ["CMD", "redis-cli", "--user", "your_redis_username", "-a", "your_strong_redis_password", "ping"]
|
|
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ==============================================================================
|
|
# Volumes
|
|
# ==============================================================================
|
|
volumes:
|
|
postgres_data:
|