mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 22:10:34 +00:00
d6e1cb23e0
* 🐳 Serve the frontend under the path of PENPOT_PUBLIC_URI Requests below the path are rewritten to the root, so a reverse proxy can forward them unchanged. The Admin Console keeps receiving the original path. AI-assisted-by: Claude Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net> * 🐳 Strip the public path before proxying to the Admin Console The Admin Console is served at the root of its own server and applies the public path at runtime, so it needs a matching Admin Console image. AI-assisted-by: Claude Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net> * 📚 Document subpath deployments in docker-compose.yaml AI-assisted-by: Claude Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net> * 📚 Describe subpath deployments without proxy rewrites The frontend now serves the subpath itself, so the reverse proxy must forward it unchanged. AI-assisted-by: Claude Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net> --------- Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
311 lines
9.8 KiB
YAML
311 lines
9.8 KiB
YAML
## Common flags:
|
|
# demo-users
|
|
# email-verification
|
|
# log-emails
|
|
# log-invitation-tokens
|
|
# login-with-github
|
|
# login-with-gitlab
|
|
# login-with-google
|
|
# login-with-ldap
|
|
# login-with-oidc
|
|
# login-with-password
|
|
# prepl-server
|
|
# registration
|
|
# secure-session-cookies
|
|
# smtp
|
|
# smtp-debug
|
|
# telemetry
|
|
# webhooks
|
|
##
|
|
## You can read more about all available flags and other
|
|
## environment variables here:
|
|
## https://help.penpot.app/technical-guide/configuration/#penpot-configuration
|
|
#
|
|
# WARNING: if you're exposing Penpot to the internet, you should remove the flags
|
|
# 'disable-secure-session-cookies' and 'disable-email-verification'
|
|
x-flags: &penpot-flags
|
|
PENPOT_FLAGS: disable-email-verification enable-smtp enable-prepl-server disable-secure-session-cookies enable-mcp enable-admin-console
|
|
|
|
## Public URI where Penpot is reached. To serve Penpot from a subpath, include
|
|
## it with a trailing slash, e.g. https://example.com/penpot/. A reverse proxy in
|
|
## front must forward the subpath unchanged, without rewriting it.
|
|
x-uri: &penpot-public-uri
|
|
PENPOT_PUBLIC_URI: http://localhost:9001
|
|
|
|
x-body-size: &penpot-http-body-size
|
|
# Max body size
|
|
PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 367001600
|
|
# Deprecation warning: this variable is deprecated. Use PENPOT_HTTP_SERVER_MAX_BODY (defaults to 367001600)
|
|
PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE: 367001600
|
|
|
|
## Penpot SECRET KEY. It serves as a master key from which other keys for subsystems
|
|
## (eg http sessions, or invitations) are derived.
|
|
##
|
|
## We recommend to use a truly randomly generated
|
|
## 512 bits base64 encoded string here. You can generate one with:
|
|
##
|
|
## python3 -c "import secrets; print(secrets.token_urlsafe(64))"
|
|
x-secret-key: &penpot-secret-key
|
|
PENPOT_SECRET_KEY: change-this-insecure-key
|
|
|
|
## Single database configuration block, shared by backend and admin-console.
|
|
## Don't touch them unless you are using custom postgresql connection parameters.
|
|
x-database: &penpot-database
|
|
PENPOT_DATABASE_URI: postgresql://penpot-postgres/penpot
|
|
PENPOT_DATABASE_USERNAME: penpot
|
|
PENPOT_DATABASE_PASSWORD: penpot
|
|
|
|
networks:
|
|
penpot:
|
|
|
|
volumes:
|
|
penpot_postgres_v15:
|
|
penpot_assets:
|
|
# penpot_mailpit_data:
|
|
# penpot_traefik:
|
|
|
|
services:
|
|
## Traefik service declaration example. Consider using it if you are going to expose
|
|
## penpot to the internet, or a different host than `localhost`.
|
|
|
|
# traefik:
|
|
# image: traefik:v3.3
|
|
# networks:
|
|
# - penpot
|
|
# command:
|
|
# - "--api.insecure=true"
|
|
# - "--entryPoints.web.address=:80"
|
|
# - "--providers.docker=true"
|
|
# - "--providers.docker.exposedbydefault=false"
|
|
# - "--entryPoints.websecure.address=:443"
|
|
# - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
|
|
# - "--certificatesresolvers.letsencrypt.acme.email=<EMAIL_ADDRESS>"
|
|
# - "--certificatesresolvers.letsencrypt.acme.storage=/traefik/acme.json"
|
|
# volumes:
|
|
# - "penpot_traefik:/traefik"
|
|
# - "/var/run/docker.sock:/var/run/docker.sock"
|
|
# ports:
|
|
# - "80:80"
|
|
# - "443:443"
|
|
|
|
penpot-frontend:
|
|
image: "penpotapp/frontend:${PENPOT_VERSION:-2.18}"
|
|
restart: always
|
|
ports:
|
|
- 9001:8080
|
|
|
|
volumes:
|
|
- penpot_assets:/opt/data/assets
|
|
|
|
depends_on:
|
|
- penpot-backend
|
|
- penpot-admin-console
|
|
- penpot-mcp
|
|
- penpot-exporter
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
# labels:
|
|
# - "traefik.enable=true"
|
|
|
|
# ## HTTPS: example of labels for the case where penpot will be exposed to the
|
|
# ## internet with HTTPS using traefik.
|
|
|
|
# - "traefik.http.routers.penpot-https.rule=Host(`<DOMAIN_NAME>`)"
|
|
# ## When Penpot is served from a subpath, match it too:
|
|
# - "traefik.http.routers.penpot-https.rule=Host(`<DOMAIN_NAME>`) && PathPrefix(`/<SUBPATH>`)"
|
|
# - "traefik.http.routers.penpot-https.entrypoints=websecure"
|
|
# - "traefik.http.routers.penpot-https.tls.certresolver=letsencrypt"
|
|
# - "traefik.http.routers.penpot-https.tls=true"
|
|
|
|
environment:
|
|
<< : [*penpot-flags, *penpot-http-body-size, *penpot-public-uri]
|
|
|
|
# Don't touch it; this uses an internal docker network to
|
|
# communicate with the admin-console.
|
|
PENPOT_ADMIN_CONSOLE_URI: http://penpot-admin-console:3000
|
|
|
|
# Set to "true" on hosts where IPv6 is disabled at kernel boot level.
|
|
# PENPOT_DISABLE_IPV6_LISTEN: "true"
|
|
|
|
penpot-backend:
|
|
image: "penpotapp/backend:${PENPOT_VERSION:-2.18}"
|
|
restart: always
|
|
|
|
volumes:
|
|
- penpot_assets:/opt/data/assets
|
|
|
|
depends_on:
|
|
penpot-postgres:
|
|
condition: service_healthy
|
|
penpot-valkey:
|
|
condition: service_healthy
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
## Configuration environment variables for the backend container.
|
|
|
|
|
|
environment:
|
|
<< : [*penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key, *penpot-database]
|
|
|
|
# Don't touch it; this uses an internal docker network to
|
|
# communicate with the admin-console.
|
|
PENPOT_ADMIN_CONSOLE_URI: http://penpot-admin-console:3000
|
|
|
|
## Valkey (or previously redis) is used for the websockets notifications. Don't touch
|
|
## unless the valkey container has different parameters or different name.
|
|
PENPOT_REDIS_URI: redis://penpot-valkey/0
|
|
|
|
## Default configuration for assets storage: using filesystem based with all files
|
|
## stored in a docker volume.
|
|
PENPOT_OBJECTS_STORAGE_BACKEND: fs
|
|
PENPOT_OBJECTS_STORAGE_FS_DIRECTORY: /opt/data/assets
|
|
|
|
## Also can be configured to to use a S3 compatible storage.
|
|
# AWS_ACCESS_KEY_ID: <KEY_ID>
|
|
# AWS_SECRET_ACCESS_KEY: <ACCESS_KEY>
|
|
# PENPOT_OBJECTS_STORAGE_BACKEND: s3
|
|
# PENPOT_OBJECTS_STORAGE_S3_ENDPOINT: <ENDPOINT>
|
|
# PENPOT_OBJECTS_STORAGE_S3_BUCKET: <BUKET_NAME>
|
|
|
|
## Telemetry. When enabled, a periodical process will send anonymous data about this
|
|
## instance. Telemetry data will enable us to learn how the application is used,
|
|
## based on real scenarios. If you want to help us, please leave it enabled. You can
|
|
## audit what data we send with the code available on github.
|
|
PENPOT_TELEMETRY_ENABLED: "true"
|
|
PENPOT_TELEMETRY_REFERER: compose
|
|
|
|
## Example SMTP/Email configuration. By default, emails are sent to the Mailpit
|
|
## service, but for production usage it is recommended to setup a real SMTP
|
|
## provider. Emails are used to confirm user registrations & invitations. Look below
|
|
## how the Mailpit service is configured.
|
|
PENPOT_SMTP_DEFAULT_FROM: no-reply@example.com
|
|
PENPOT_SMTP_DEFAULT_REPLY_TO: no-reply@example.com
|
|
PENPOT_SMTP_HOST: penpot-mailpit
|
|
PENPOT_SMTP_PORT: 1025
|
|
PENPOT_SMTP_USERNAME:
|
|
PENPOT_SMTP_PASSWORD:
|
|
PENPOT_SMTP_TLS: "false"
|
|
PENPOT_SMTP_SSL: "false"
|
|
|
|
penpot-admin-console:
|
|
image: "penpotapp/admin-console:${PENPOT_VERSION:-2.18}"
|
|
restart: always
|
|
|
|
depends_on:
|
|
penpot-postgres:
|
|
condition: service_healthy
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
environment:
|
|
<< : [*penpot-public-uri, *penpot-secret-key, *penpot-database]
|
|
|
|
# Don't touch it; this uses an internal docker network to
|
|
# communicate with the frontend.
|
|
PENPOT_INTERNAL_URI: http://penpot-frontend:8080
|
|
|
|
penpot-mcp:
|
|
image: "penpotapp/mcp:${PENPOT_VERSION:-2.18}"
|
|
restart: always
|
|
networks:
|
|
- penpot
|
|
|
|
penpot-exporter:
|
|
image: "penpotapp/exporter:${PENPOT_VERSION:-2.18}"
|
|
restart: always
|
|
|
|
depends_on:
|
|
penpot-valkey:
|
|
condition: service_healthy
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
environment:
|
|
<< : [*penpot-flags, *penpot-secret-key, *penpot-public-uri]
|
|
|
|
# Don't touch it; this uses an internal docker network to
|
|
# communicate with the frontend.
|
|
PENPOT_INTERNAL_URI: http://penpot-frontend:8080
|
|
|
|
## Valkey (or previously Redis) is used for the websockets notifications
|
|
## and for storing the state export jobs
|
|
PENPOT_REDIS_URI: redis://penpot-valkey/0
|
|
|
|
# PENPOT_EXPORTER_MAX_CONCURRENT_JOBS: 4
|
|
# PENPOT_EXPORTER_MAX_JOBS_PER_PROFILE: 2
|
|
# PENPOT_EXPORTER_QUEUE_MAX: 64
|
|
# PENPOT_EXPORTER_JOB_TTL: 3600
|
|
# PENPOT_WASM_WORKER_POOL_MAX: 2
|
|
# PENPOT_WASM_WORKER_POOL_MIN: 1
|
|
# PENPOT_WASM_WORKER_IDLE_TIMEOUT: 300
|
|
# PENPOT_WASM_WORKER_IMAGE_CACHE_SIZE: 134217728
|
|
|
|
penpot-postgres:
|
|
image: "postgres:15"
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U penpot"]
|
|
interval: 2s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 2s
|
|
|
|
volumes:
|
|
- penpot_postgres_v15:/var/lib/postgresql/data
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
environment:
|
|
- POSTGRES_INITDB_ARGS=--data-checksums
|
|
- POSTGRES_DB=penpot
|
|
- POSTGRES_USER=penpot
|
|
- POSTGRES_PASSWORD=penpot
|
|
|
|
penpot-valkey:
|
|
image: valkey/valkey:8.1
|
|
restart: always
|
|
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
|
|
interval: 1s
|
|
timeout: 3s
|
|
retries: 5
|
|
start_period: 3s
|
|
|
|
networks:
|
|
- penpot
|
|
|
|
environment:
|
|
# You can increase the max memory size if you have sufficient resources,
|
|
# although this should not be necessary.
|
|
- VALKEY_EXTRA_FLAGS=--maxmemory 128mb --maxmemory-policy volatile-lfu
|
|
|
|
## A Mailpit service, used as temporal SMTP server. You can access via HTTP to the
|
|
## port 8025 to read all emails the penpot platform has sent. Should be only used as a
|
|
## temporal solution while no real SMTP provider is configured. Messages are kept in
|
|
## memory only and are lost when the container is recreated; uncomment the volume
|
|
## below (and the one in the top-level volumes: section) to persist them instead.
|
|
|
|
penpot-mailpit:
|
|
image: axllent/mailpit:v1
|
|
restart: always
|
|
# volumes:
|
|
# - penpot_mailpit_data:/data
|
|
# environment:
|
|
# - MP_DATABASE=/data/mailpit.db
|
|
expose:
|
|
- '1025'
|
|
ports:
|
|
- "8025:8025"
|
|
networks:
|
|
- penpot
|