diff --git a/docker-compose.yml b/docker-compose.yml index 1fbc869..deb6e05 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,33 +3,33 @@ version: "3" services: postgres: restart: unless-stopped - networks: - - default env_file: .env environment: - "POSTGRES_HOST_AUTH_METHOD=trust" - image: postgres:11 + image: postgres:15-alpine + networks: + - default volumes: - ./data/postgres:/var/lib/postgresql/data redis: restart: unless-stopped + env_file: .env + image: redis:7-alpine networks: - default - env_file: .env - image: redis:5 volumes: - ./data/redis:/data celeryworker: restart: unless-stopped - image: funkwhale/funkwhale:${FUNKWHALE_VERSION:-latest} - networks: - - default + image: funkwhale/api:${FUNKWHALE_VERSION:-latest} depends_on: - postgres - redis env_file: .env + networks: + - default # Celery workers handle background tasks (such file imports or federation # messaging). The more processes a worker gets, the more tasks # can be processed in parallel. However, more processes also means @@ -38,7 +38,12 @@ services: # of CPUs. You can adjust this, by explicitly setting the --concurrency # flag: # celery -A funkwhale_api.taskapp worker -l INFO --concurrency=4 - command: celery -A funkwhale_api.taskapp worker -l INFO --concurrency=${CELERYD_CONCURRENCY-0} + command: + - celery + - --app=funkwhale_api.taskapp + - worker + - --loglevel=INFO + - --concurrency=${CELERYD_CONCURRENCY-0} environment: - C_FORCE_ROOT=true volumes: @@ -47,18 +52,22 @@ services: celerybeat: restart: unless-stopped - image: funkwhale/funkwhale:${FUNKWHALE_VERSION:-latest} + image: funkwhale/api:${FUNKWHALE_VERSION:-latest} networks: - default + command: + - celery + - --app=funkwhale_api.taskapp + - beat + - --loglevel=INFO depends_on: - postgres - redis env_file: .env - command: celery -A funkwhale_api.taskapp beat --pidfile= -l INFO api: restart: unless-stopped - image: funkwhale/funkwhale:${FUNKWHALE_VERSION:-latest} + image: funkwhale/api:${FUNKWHALE_VERSION:-latest} networks: default: aliases: @@ -72,13 +81,10 @@ services: - "${MUSIC_DIRECTORY_SERVE_PATH-/srv/funkwhale/data/music}:${MUSIC_DIRECTORY_PATH-/music}:ro" - "${MEDIA_ROOT}:${MEDIA_ROOT}" - "${STATIC_ROOT}:${STATIC_ROOT}" - - "${FUNKWHALE_FRONTEND_PATH}:/frontend" - ports: - - "5000" - nginx: + front: restart: unless-stopped - image: nginx + image: funkwhale/front:${FUNKWHALE_VERSION:-latest} networks: - default - httpsproxy @@ -93,19 +99,13 @@ services: - "traefik.http.routers.funkwhale.tls.certresolver=leresolver" - "traefik.http.routers.funkwhale.entrypoints=websecure" + environment: + # Override those variables in your .env file if needed + - "NGINX_MAX_BODY_SIZE=${NGINX_MAX_BODY_SIZE-100M}" volumes: - - "./nginx/funkwhale.template:/etc/nginx/conf.d/funkwhale.template:ro" - - "./nginx/funkwhale_proxy.conf:/etc/nginx/funkwhale_proxy.conf:ro" - "${MUSIC_DIRECTORY_SERVE_PATH-/srv/funkwhale/data/music}:${MUSIC_DIRECTORY_PATH-/music}:ro" - "${MEDIA_ROOT}:${MEDIA_ROOT}:ro" - - "${STATIC_ROOT}:${STATIC_ROOT}:ro" - - "${FUNKWHALE_FRONTEND_PATH}:/frontend:ro" - command: > - sh -c "envsubst \"`env | awk -F = '{printf \" $$%s\", $$1}'`\" - < /etc/nginx/conf.d/funkwhale.template - > /etc/nginx/conf.d/default.conf - && cat /etc/nginx/conf.d/default.conf - && nginx -g 'daemon off;'" + - "${STATIC_ROOT}:/usr/share/nginx/html/staticfiles:ro" networks: mail: diff --git a/nginx/funkwhale.template b/nginx/funkwhale.template index 6bdb5b1..6e4c4e7 100644 --- a/nginx/funkwhale.template +++ b/nginx/funkwhale.template @@ -1,111 +1 @@ -upstream funkwhale-api { - # depending on your setup, you may want to update this - server funkwhale_api:5000; -} - - -# required for websocket support -map $http_upgrade $connection_upgrade { - default upgrade; - '' close; -} - -server { - listen 80; - server_name ${FUNKWHALE_HOSTNAME}; - - # TLS - # Feel free to use your own configuration for SSL here or simply remove the - # lines and move the configuration to the previous server block if you - # don't want to run funkwhale behind https (this is not recommended) - # have a look here for let's encrypt configuration: - # https://certbot.eff.org/all-instructions/#debian-9-stretch-nginx - - root /frontend; - - # If you are using S3 to host your files, remember to add your S3 URL to the - # media-src and img-src headers (e.g. img-src 'self' https:// data:) - - add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' https://*.digitaloceanspaces.com data:; font-src 'self' data:; object-src 'none'; media-src 'self' https://*.digitaloceanspaces.com data:"; - add_header Referrer-Policy "strict-origin-when-cross-origin"; - add_header X-Frame-Options "SAMEORIGIN" always; - - location / { - include /etc/nginx/funkwhale_proxy.conf; - # this is needed if you have file import via upload enabled - client_max_body_size ${NGINX_MAX_BODY_SIZE}; - proxy_pass http://funkwhale-api/; - } - - location /front/ { - add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:"; - add_header Referrer-Policy "strict-origin-when-cross-origin"; - add_header Service-Worker-Allowed "/"; - alias /frontend/; - expires 30d; - add_header Pragma public; - add_header Cache-Control "public, must-revalidate, proxy-revalidate"; - } - - location /front/embed.html { - add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:"; - add_header Referrer-Policy "strict-origin-when-cross-origin"; - - add_header X-Frame-Options "" always; - alias /frontend/embed.html; - expires 30d; - add_header Pragma public; - add_header Cache-Control "public, must-revalidate, proxy-revalidate"; - } - - location /federation/ { - include /etc/nginx/funkwhale_proxy.conf; - proxy_pass http://funkwhale-api/federation/; - } - - # You can comment this if you do not plan to use the Subsonic API - location /rest/ { - include /etc/nginx/funkwhale_proxy.conf; - proxy_pass http://funkwhale-api/api/subsonic/rest/; - } - - location /.well-known/ { - include /etc/nginx/funkwhale_proxy.conf; - proxy_pass http://funkwhale-api/.well-known/; - } - - location /media/ { - alias ${MEDIA_ROOT}/; - } - - # this is an internal location that is used to serve - # audio files once correct permission / authentication - # has been checked on API side - #location /_protected/media { - # internal; - # alias ${MEDIA_ROOT}; - - #} - # Comment the previous location and uncomment this one if you're storing - # media files in a S3 bucket - location ~ /_protected/media/(.+) { - internal; - # Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932 - proxy_set_header Authorization ""; - proxy_pass $1; - } - - location /_protected/music { - # this is an internal location that is used to serve - # audio files once correct permission / authentication - # has been checked on API side - # Set this to the same value as your MUSIC_DIRECTORY_PATH setting - internal; - alias ${MUSIC_DIRECTORY_PATH}; - } - - location /staticfiles/ { - # django static files - alias ${STATIC_ROOT}/; - } -} +../front/docker/funkwhale.conf.template \ No newline at end of file diff --git a/nginx/funkwhale_proxy.conf b/nginx/funkwhale_proxy.conf index dccc782..8bbfaab 100644 --- a/nginx/funkwhale_proxy.conf +++ b/nginx/funkwhale_proxy.conf @@ -1,19 +1 @@ -# use this one if you put the nginx container behind another proxy -# you will have to set some headers on this proxy as well to ensure -# everything works correctly, you can use the ones from the funkwhale_proxy.conf file -# at https://dev.funkwhale.audio/funkwhale/funkwhale/blob/develop/deploy/funkwhale_proxy.conf -# your proxy will also need to support websockets - -proxy_set_header Host $host; -proxy_set_header X-Real-IP $remote_addr; - -proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; -proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; -proxy_set_header X-Forwarded-Host $http_x_forwarded_host; -proxy_set_header X-Forwarded-Port $http_x_forwarded_port; -proxy_redirect off; - -# websocket support -proxy_http_version 1.1; -proxy_set_header Upgrade $http_upgrade; -proxy_set_header Connection $connection_upgrade; +../front/docker/funkwhale_proxy.conf \ No newline at end of file