f89e074dd1
Governed substrate for autonomous agents: scoped identity (passports), audited actions, MCP workspace. Infra IPs and secrets redacted for public release.
93 lines
3.4 KiB
YAML
93 lines
3.4 KiB
YAML
# Penpot self-hosted — GOD CRM design instance (new prod box .128).
|
|
# Self-contained (own postgres + redis), no host-pg coupling.
|
|
#
|
|
# Serves TWO design domains off this single instance:
|
|
# - design.godcrm.ai -> .128 nginx -> 127.0.0.1:9011 (direct)
|
|
# - design.hltrn.cc -> .72 nginx -> proxy to .128 (Host rewritten to design.godcrm.ai)
|
|
#
|
|
# SSO: "Login with GOD CRM" via the CRM OIDC provider (oidc_clients.client_id=penpot),
|
|
# same pattern as WorkAdventure. All OIDC endpoints are explicit so penpot skips
|
|
# discovery and never touches the (previously stale) crm.hltrn.cc cert.
|
|
#
|
|
# Secrets are injected from ./penpot.env (gitignored). Copy penpot.env.example -> penpot.env
|
|
# and fill real values. NEVER commit real secrets here (private repo or not).
|
|
volumes:
|
|
penpot_assets:
|
|
penpot_postgres:
|
|
|
|
services:
|
|
penpot-frontend:
|
|
image: penpotapp/frontend:latest
|
|
restart: always
|
|
ports:
|
|
- "127.0.0.1:9011:8080"
|
|
volumes:
|
|
- penpot_assets:/opt/data/assets
|
|
depends_on:
|
|
- penpot-backend
|
|
- penpot-exporter
|
|
environment:
|
|
- PENPOT_FLAGS=enable-login-with-password enable-login-with-oidc disable-registration disable-email-verification
|
|
- PENPOT_OIDC_NAME=GOD CRM
|
|
|
|
penpot-backend:
|
|
image: penpotapp/backend:latest
|
|
restart: always
|
|
volumes:
|
|
- penpot_assets:/opt/data/assets
|
|
depends_on:
|
|
penpot-postgres:
|
|
condition: service_healthy
|
|
penpot-redis:
|
|
condition: service_started
|
|
environment:
|
|
- PENPOT_FLAGS=enable-login-with-password enable-login-with-oidc enable-oidc-registration disable-registration disable-email-verification enable-prepl-server
|
|
- PENPOT_SECRET_KEY=${PENPOT_SECRET_KEY}
|
|
- PENPOT_PUBLIC_URI=https://design.hltrn.cc
|
|
# --- SSO via GOD CRM OIDC provider (ADR-063 pattern, same as WorkAdventure) ---
|
|
# All endpoints explicit -> penpot skips discovery (never hits stale crm.hltrn.cc cert).
|
|
- PENPOT_OIDC_CLIENT_ID=penpot
|
|
- PENPOT_OIDC_CLIENT_SECRET=${PENPOT_OIDC_CLIENT_SECRET}
|
|
- PENPOT_OIDC_BASE_URI=https://godcrm.ai
|
|
- PENPOT_OIDC_AUTH_URI=https://godcrm.ai/oauth/authorize
|
|
- PENPOT_OIDC_TOKEN_URI=https://godcrm.ai/oauth/token
|
|
- PENPOT_OIDC_USER_URI=https://godcrm.ai/oauth/userinfo
|
|
- PENPOT_OIDC_JWKS_URI=https://godcrm.ai/oauth/jwks
|
|
- PENPOT_OIDC_SCOPES=openid profile email
|
|
- PENPOT_OIDC_NAME_ATTR=name
|
|
- PENPOT_OIDC_EMAIL_ATTR=email
|
|
- PENPOT_DATABASE_URI=postgresql://penpot-postgres:5432/penpot
|
|
- PENPOT_DATABASE_USERNAME=penpot
|
|
- PENPOT_DATABASE_PASSWORD=${PENPOT_DB_PASSWORD}
|
|
- PENPOT_REDIS_URI=redis://penpot-redis/0
|
|
- PENPOT_ASSETS_STORAGE_BACKEND=assets-fs
|
|
- PENPOT_STORAGE_ASSETS_FS_DIRECTORY=/opt/data/assets
|
|
- PENPOT_TELEMETRY_ENABLED=false
|
|
|
|
penpot-exporter:
|
|
image: penpotapp/exporter:latest
|
|
restart: always
|
|
environment:
|
|
- PENPOT_SECRET_KEY=${PENPOT_SECRET_KEY}
|
|
- PENPOT_PUBLIC_URI=http://penpot-frontend:8080
|
|
- PENPOT_REDIS_URI=redis://penpot-redis/0
|
|
|
|
penpot-postgres:
|
|
image: postgres:15
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U penpot"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
volumes:
|
|
- penpot_postgres:/var/lib/postgresql/data
|
|
environment:
|
|
- POSTGRES_DB=penpot
|
|
- POSTGRES_USER=penpot
|
|
- POSTGRES_PASSWORD=${PENPOT_DB_PASSWORD}
|
|
|
|
penpot-redis:
|
|
image: redis:7-alpine
|
|
restart: always
|