My NixOS dotfiles
✨ docker composes
Simon R. - fantomitechno
(Jun 30, 2026, 11:55 AM +0200)
0df277f1
bbd7f096
+1269
-8
+302
docker/fant0mib0t/cryptpad/config.js
+302
docker/fant0mib0t/cryptpad/config.js
···
1
+
module.exports = {
2
+
/* httpUnsafeOrigin is the URL that clients will enter to load your instance.
3
+
* Any other URL that somehow points to your instance is supposed to be blocked.
4
+
* The default provided below assumes you are loading CryptPad from a server
5
+
* which is running on the same machine, using port 3000.
6
+
*
7
+
* In a production instance this should be available ONLY over HTTPS
8
+
* using the default port for HTTPS (443) ie. https://cryptpad.fr
9
+
* In such a case this should be also handled by NGINX, as documented in
10
+
* cryptpad/docs/example.nginx.conf (see the $main_domain variable)
11
+
*
12
+
*/
13
+
httpUnsafeOrigin: 'https://drive.renoux.dev',
14
+
15
+
/* httpSafeOrigin is the URL used for the 'sandbox' described above.
16
+
* If you're testing or developing with CryptPad on your local machine then
17
+
* it is appropriate to leave this blank. The default behaviour is to serve
18
+
* the main domain over port 3000 and to serve the sandbox content over port 3001.
19
+
*
20
+
* This is not appropriate in a production environment where invasive networks
21
+
* may filter traffic going over abnormal ports.
22
+
* To correctly configure your production instance you must provide a URL
23
+
* with a different domain (a subdomain is sufficient).
24
+
* It will be used to load the UI in our 'sandbox' system.
25
+
*
26
+
* This value corresponds to the $sandbox_domain variable
27
+
* in the example nginx file.
28
+
*
29
+
* Note that in order for the sandboxing system to be effective
30
+
* httpSafeOrigin must be different from httpUnsafeOrigin.
31
+
*
32
+
* CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS.
33
+
*/
34
+
httpSafeOrigin: "https://drive.s.renoux.dev",
35
+
36
+
/* httpAddress specifies the address on which the nodejs server
37
+
* should be accessible. By default it will listen on localhost
38
+
* (IPv4 & IPv6 if enabled). If you want it to listen on
39
+
* a specific address, specify it here. e.g '192.168.0.1'
40
+
*
41
+
*/
42
+
httpAddress: '127.0.0.1',
43
+
44
+
/* httpPort specifies on which port the nodejs server should listen.
45
+
* By default it will serve content over port 3000, which is suitable
46
+
* for both local development and for use with the provided nginx example,
47
+
* which will proxy websocket traffic to your node server.
48
+
*
49
+
*/
50
+
httpPort: 4020,
51
+
52
+
/* httpSafePort purpose is to emulate another origin for the sandbox when
53
+
* you don't have two domains at hand (i.e. when httpSafeOrigin not defined).
54
+
* It is meant to be used only in case where you are working on a local
55
+
* development instance. The default value is your httpPort + 1.
56
+
*
57
+
*/
58
+
//httpSafePort: 3001,
59
+
60
+
/* Websockets need to be exposed on a separate port from the rest of
61
+
* the platform's HTTP traffic. Port 3003 is used by default.
62
+
* You can change this to a different port if it is in use by a
63
+
* different service, but under most circumstances you can leave this
64
+
* commented and it will work.
65
+
*
66
+
* In production environments, your reverse proxy (usually NGINX)
67
+
* will need to forward websocket traffic (/cryptpad_websocket)
68
+
* to this port.
69
+
*
70
+
*/
71
+
websocketPort: 4021,
72
+
73
+
/* CryptPad will launch a child process for every core available
74
+
* in order to perform CPU-intensive tasks in parallel.
75
+
* Some host environments may have a very large number of cores available
76
+
* or you may want to limit how much computing power CryptPad can take.
77
+
* If so, set 'maxWorkers' to a positive integer.
78
+
*/
79
+
// maxWorkers: 4,
80
+
81
+
/* =====================
82
+
* Sessions
83
+
* ===================== */
84
+
85
+
/* Accounts can be protected with an OTP (One Time Password) system
86
+
* to add a second authentication layer. Such accounts use a session
87
+
* with a given lifetime after which they are logged out and need
88
+
* to be re-authenticated. You can configure the lifetime of these
89
+
* sessions here.
90
+
*
91
+
* defaults to 7 days
92
+
*/
93
+
//otpSessionExpiration: 7*24, // hours
94
+
95
+
/* Registered users can be forced to protect their account
96
+
* with a Multi-factor Authentication (MFA) tool like a TOTP
97
+
* authenticator application.
98
+
*
99
+
* defaults to false
100
+
*/
101
+
//enforceMFA: false,
102
+
103
+
/* =====================
104
+
* Privacy
105
+
* ===================== */
106
+
107
+
/* Depending on where your instance is hosted, you may be required to log IP
108
+
* addresses of the users who make a change to a document. This setting allows you
109
+
* to do so. You can configure the logging system below in this config file.
110
+
* Setting this value to true will include a log for each websocket connection
111
+
* including this connection's unique ID, the user public key and the IP.
112
+
* NOTE: this option requires a log level of "info" or below.
113
+
*
114
+
* defaults to false
115
+
*/
116
+
//logIP: false,
117
+
118
+
/* =====================
119
+
* Admin
120
+
* ===================== */
121
+
122
+
/*
123
+
* CryptPad contains an administration panel. Its access is restricted to specific
124
+
* users using the following list and the management interface on the instance.
125
+
* To give access to the admin panel to a user account, just add their public signing
126
+
* key, which can be found on the settings page for registered users. Access can be
127
+
* revoked directly from the interface, unless you added the key below.
128
+
* Entries should be strings separated by a comma.
129
+
* adminKeys: [
130
+
* "[cryptpad-user1@my.awesome.website/YZgXQxKR0Rcb6r6CmxHPdAGLVludrAF2lEnkbx1vVOo=]",
131
+
* "[cryptpad-user2@my.awesome.website/jA-9c5iNuG7SyxzGCjwJXVnk5NPfAOO8fQuQ0dC83RE=]",
132
+
* ]
133
+
*
134
+
*/
135
+
adminKeys: [
136
+
137
+
],
138
+
139
+
/* =====================
140
+
* STORAGE
141
+
* ===================== */
142
+
143
+
/* Pads that are not 'pinned' by any registered user can be set to expire
144
+
* after a configurable number of days of inactivity (default 90 days).
145
+
* The value can be changed or set to false to remove expiration.
146
+
* Expired pads can then be removed using a cron job calling the
147
+
* `evict-inactive.js` script with node
148
+
*
149
+
* defaults to 90 days if nothing is provided
150
+
*/
151
+
//inactiveTime: 90, // days
152
+
153
+
/* CryptPad archives some data instead of deleting it outright.
154
+
* This archived data still takes up space and so you'll probably still want to
155
+
* remove these files after a brief period.
156
+
*
157
+
* cryptpad/scripts/evict-archived.js is intended to be run daily
158
+
* from a crontab or similar scheduling service.
159
+
*
160
+
* The intent with this feature is to provide a safety net in case of accidental
161
+
* deletion. Set this value to the number of days you'd like to retain
162
+
* archived data before it's removed permanently.
163
+
*
164
+
* defaults to 15 days if nothing is provided
165
+
*/
166
+
//archiveRetentionTime: 15,
167
+
168
+
/* It's possible to configure your instance to remove data
169
+
* stored on behalf of inactive accounts. Set 'accountRetentionTime'
170
+
* to the number of days an account can remain idle before its
171
+
* documents and other account data is removed.
172
+
*
173
+
* Leave this value commented out to preserve all data stored
174
+
* by user accounts regardless of inactivity.
175
+
*/
176
+
//accountRetentionTime: 365,
177
+
178
+
/* Starting with CryptPad 3.23.0, the server automatically runs
179
+
* the script responsible for removing inactive data according to
180
+
* your configured definition of inactivity. Set this value to `true`
181
+
* if you prefer not to remove inactive data, or if you prefer to
182
+
* do so manually using `scripts/evict-inactive.js`.
183
+
*/
184
+
//disableIntegratedEviction: true,
185
+
186
+
187
+
/* Max Upload Size (bytes)
188
+
* this sets the maximum size of any one file uploaded to the server.
189
+
* anything larger than this size will be rejected
190
+
* defaults to 20MB if no value is provided
191
+
*/
192
+
//maxUploadSize: 20 * 1024 * 1024,
193
+
194
+
/* Users with premium accounts (those with a plan included in their customLimit)
195
+
* can benefit from an increased upload size limit. By default they are restricted to the same
196
+
* upload size as any other registered user.
197
+
*
198
+
*/
199
+
//premiumUploadSize: 100 * 1024 * 1024,
200
+
201
+
/* =====================
202
+
* DATABASE VOLUMES
203
+
* ===================== */
204
+
205
+
/*
206
+
* CryptPad stores each document in an individual file on your hard drive.
207
+
* Specify a directory where files should be stored.
208
+
* It will be created automatically if it does not already exist.
209
+
*/
210
+
filePath: './datastore/',
211
+
212
+
/* CryptPad offers the ability to archive data for a configurable period
213
+
* before deleting it, allowing a means of recovering data in the event
214
+
* that it was deleted accidentally.
215
+
*
216
+
* To set the location of this archive directory to a custom value, change
217
+
* the path below:
218
+
*/
219
+
archivePath: './data/archive',
220
+
221
+
/* CryptPad allows logged in users to request that the server
222
+
* store particular documents indefinitely. This is called 'pinning'.
223
+
* Pin requests are stored in a pin-store. The location of this store is
224
+
* defined here.
225
+
*/
226
+
pinPath: './data/pins',
227
+
228
+
/* if you would like the list of scheduled tasks to be stored in
229
+
a custom location, change the path below:
230
+
*/
231
+
taskPath: './data/tasks',
232
+
233
+
/* if you would like users' authenticated blocks to be stored in
234
+
a custom location, change the path below:
235
+
*/
236
+
blockPath: './block',
237
+
238
+
/* CryptPad allows logged in users to upload encrypted files. Files/blobs
239
+
* are stored in a 'blob-store'. Set its location here.
240
+
*/
241
+
blobPath: './blob',
242
+
243
+
/* CryptPad stores incomplete blobs in a 'staging' area until they are
244
+
* fully uploaded. Set its location here.
245
+
*/
246
+
blobStagingPath: './data/blobstage',
247
+
248
+
decreePath: './data/decrees',
249
+
250
+
/* CryptPad supports logging events directly to the disk in a 'logs' directory
251
+
* Set its location here, or set it to false (or nothing) if you'd rather not log
252
+
*/
253
+
logPath: './data/logs',
254
+
255
+
/* =====================
256
+
* Debugging
257
+
* ===================== */
258
+
259
+
/* CryptPad can log activity to stdout
260
+
* This may be useful for debugging
261
+
*/
262
+
logToStdout: false,
263
+
264
+
/* CryptPad can be configured to log more or less
265
+
* the various settings are listed below by order of importance
266
+
*
267
+
* silly, verbose, debug, feedback, info, warn, error
268
+
*
269
+
* Choose the least important level of logging you wish to see.
270
+
* For example, a 'silly' logLevel will display everything,
271
+
* while 'info' will display 'info', 'warn', and 'error' logs
272
+
*
273
+
* This will affect both logging to the console and the disk.
274
+
*/
275
+
logLevel: 'info',
276
+
277
+
/* clients can use the /settings/ app to opt out of usage feedback
278
+
* which informs the server of things like how much each app is being
279
+
* used, and whether certain clientside features are supported by
280
+
* the client's browser. The intent is to provide feedback to the admin
281
+
* such that the service can be improved. Enable this with `true`
282
+
* and ignore feedback with `false` or by commenting the attribute
283
+
*
284
+
* You will need to set your logLevel to include 'feedback'. Set this
285
+
* to false if you'd like to exclude feedback from your logs.
286
+
*/
287
+
logFeedback: false,
288
+
289
+
/* CryptPad supports verbose logging
290
+
* (false by default)
291
+
*/
292
+
verbose: false,
293
+
294
+
/* Surplus information:
295
+
*
296
+
* 'installMethod' is included in server telemetry to voluntarily
297
+
* indicate how many instances are using unofficial installation methods
298
+
* such as Docker.
299
+
*
300
+
*/
301
+
installMethod: 'nuhuh',
302
+
};
+32
docker/fant0mib0t/cryptpad/docker-compose.yml
+32
docker/fant0mib0t/cryptpad/docker-compose.yml
···
1
+
services:
2
+
cryptpad:
3
+
image: "cryptpad/cryptpad:version-2026.5.1"
4
+
hostname: cryptpad
5
+
6
+
environment:
7
+
- CPAD_MAIN_DOMAIN=https://drive.renoux.dev
8
+
- CPAD_SANDBOX_DOMAIN=https://drive.s.renoux.dev
9
+
- CPAD_CONF=/cryptpad/config/config.js
10
+
11
+
# Read and accept the license before uncommenting the following line:
12
+
# https://github.com/ONLYOFFICE/web-apps/blob/master/LICENSE.txt
13
+
- CPAD_INSTALL_ONLYOFFICE=yes
14
+
15
+
volumes:
16
+
- /nas/cryptpad/blob:/cryptpad/blob
17
+
- /nas/cryptpad/block:/cryptpad/block
18
+
- /nas/cryptpad/customize:/cryptpad/customize
19
+
- /nas/cryptpad/data:/cryptpad/data
20
+
- /nas/cryptpad/files:/cryptpad/datastore
21
+
- /nas/cryptpad/onlyoffice-dist:/cryptpad/www/common/onlyoffice/dist
22
+
- /nas/cryptpad/onlyoffice-conf:/cryptpad/onlyoffice-conf
23
+
- ./config.js:/cryptpad/config/config.js
24
+
25
+
ports:
26
+
- "127.0.0.1:3000:3000"
27
+
- "127.0.0.1:3003:3003"
28
+
29
+
ulimits:
30
+
nofile:
31
+
soft: 1000000
32
+
hard: 1000000
+9
docker/fant0mib0t/hold/config.yaml
+9
docker/fant0mib0t/hold/config.yaml
+20
docker/fant0mib0t/hold/docker-compose.yml
+20
docker/fant0mib0t/hold/docker-compose.yml
···
1
+
services:
2
+
tranquil-pds:
3
+
image: atcr.io/seamark.cr/appview:v0.1.2-arm64
4
+
restart: unless-stopped
5
+
command: ["serve", "--config", "/config.yaml"]
6
+
environment:
7
+
SERVER_HOST: "[::]"
8
+
ports:
9
+
- "127.0.0.1:4010:8080"
10
+
volumes:
11
+
- ./config.yaml:/config.yaml:ro
12
+
- /nas/atcr/hold:/var/lib/atcr-hold
13
+
env_file:
14
+
- .env
15
+
healthcheck:
16
+
test: ["CMD", "/healthcheck", "http://localhost:8080/xrpc/_health"]
17
+
interval: 30s
18
+
timeout: 10s
19
+
retries: 3
20
+
start_period: 30s
+63
docker/fant0mib0t/immich/docker-compose.yml
+63
docker/fant0mib0t/immich/docker-compose.yml
···
1
+
services:
2
+
immich-server:
3
+
container_name: immich_server
4
+
image: ghcr.io/immich-app/immich-server:v2.7.5
5
+
# extends:
6
+
# file: hwaccel.transcoding.yml
7
+
# service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
8
+
volumes:
9
+
- /nas/immich/library:/data
10
+
- /etc/localtime:/etc/localtime:ro
11
+
env_file:
12
+
- .env
13
+
ports:
14
+
- "127.0.0.1:4040:2283"
15
+
depends_on:
16
+
- redis
17
+
- database
18
+
restart: always
19
+
healthcheck:
20
+
disable: false
21
+
22
+
immich-machine-learning:
23
+
container_name: immich_machine_learning
24
+
# For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
25
+
# Example tag: v2.7.5-cuda
26
+
image: ghcr.io/immich-app/immich-machine-learning:v2.7.5
27
+
# extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
28
+
# file: hwaccel.ml.yml
29
+
# service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
30
+
volumes:
31
+
- model-cache:/cache
32
+
env_file:
33
+
- .env
34
+
restart: always
35
+
healthcheck:
36
+
disable: false
37
+
38
+
redis:
39
+
container_name: immich_redis
40
+
image: docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
41
+
healthcheck:
42
+
test: redis-cli ping || exit 1
43
+
restart: always
44
+
45
+
database:
46
+
container_name: immich_postgres
47
+
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
48
+
environment:
49
+
POSTGRES_PASSWORD: ${DB_PASSWORD}
50
+
POSTGRES_USER: ${DB_USERNAME}
51
+
POSTGRES_DB: ${DB_DATABASE_NAME}
52
+
POSTGRES_INITDB_ARGS: "--data-checksums"
53
+
# Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
54
+
DB_STORAGE_TYPE: "HDD"
55
+
volumes:
56
+
- /nas/immich/pg_data:/var/lib/postgresql/data
57
+
shm_size: 128mb
58
+
restart: always
59
+
healthcheck:
60
+
disable: false
61
+
62
+
volumes:
63
+
model-cache:
+57
docker/fant0mib0t/immich/hwaccel.ml.yml
+57
docker/fant0mib0t/immich/hwaccel.ml.yml
···
1
+
# Configurations for hardware-accelerated machine learning
2
+
3
+
# If using Unraid or another platform that doesn't allow multiple Compose files,
4
+
# you can inline the config for a backend by copying its contents
5
+
# into the immich-machine-learning service in the docker-compose.yml file.
6
+
7
+
# See https://docs.immich.app/features/ml-hardware-acceleration for info on usage.
8
+
9
+
services:
10
+
armnn:
11
+
devices:
12
+
- /dev/mali0:/dev/mali0
13
+
volumes:
14
+
- /lib/firmware/mali_csffw.bin:/lib/firmware/mali_csffw.bin:ro # Mali firmware for your chipset (not always required depending on the driver)
15
+
- /usr/lib/libmali.so:/usr/lib/libmali.so:ro # Mali driver for your chipset (always required)
16
+
17
+
rknn:
18
+
security_opt:
19
+
- systempaths=unconfined
20
+
- apparmor=unconfined
21
+
devices:
22
+
- /dev/dri:/dev/dri
23
+
24
+
cpu: {}
25
+
26
+
cuda:
27
+
deploy:
28
+
resources:
29
+
reservations:
30
+
devices:
31
+
- driver: nvidia
32
+
count: 1
33
+
capabilities:
34
+
- gpu
35
+
36
+
rocm:
37
+
group_add:
38
+
- video
39
+
devices:
40
+
- /dev/dri:/dev/dri
41
+
- /dev/kfd:/dev/kfd
42
+
43
+
openvino:
44
+
device_cgroup_rules:
45
+
- 'c 189:* rmw'
46
+
devices:
47
+
- /dev/dri:/dev/dri
48
+
volumes:
49
+
- /dev/bus/usb:/dev/bus/usb
50
+
51
+
openvino-wsl:
52
+
devices:
53
+
- /dev/dri:/dev/dri
54
+
- /dev/dxg:/dev/dxg
55
+
volumes:
56
+
- /dev/bus/usb:/dev/bus/usb
57
+
- /usr/lib/wsl:/usr/lib/wsl
+55
docker/fant0mib0t/immich/hwaccel.transcoding.yml
+55
docker/fant0mib0t/immich/hwaccel.transcoding.yml
···
1
+
# Configurations for hardware-accelerated transcoding
2
+
3
+
# If using Unraid or another platform that doesn't allow multiple Compose files,
4
+
# you can inline the config for a backend by copying its contents
5
+
# into the immich-microservices service in the docker-compose.yml file.
6
+
7
+
# See https://docs.immich.app/features/hardware-transcoding for more info on using hardware transcoding.
8
+
9
+
services:
10
+
cpu: {}
11
+
12
+
nvenc:
13
+
deploy:
14
+
resources:
15
+
reservations:
16
+
devices:
17
+
- driver: nvidia
18
+
count: 1
19
+
capabilities:
20
+
- gpu
21
+
- compute
22
+
- video
23
+
24
+
quicksync:
25
+
devices:
26
+
- /dev/dri:/dev/dri
27
+
28
+
rkmpp:
29
+
security_opt: # enables full access to /sys and /proc, still far better than privileged: true
30
+
- systempaths=unconfined
31
+
- apparmor=unconfined
32
+
group_add:
33
+
- video
34
+
devices:
35
+
- /dev/rga:/dev/rga
36
+
- /dev/dri:/dev/dri
37
+
- /dev/dma_heap:/dev/dma_heap
38
+
- /dev/mpp_service:/dev/mpp_service
39
+
#- /dev/mali0:/dev/mali0 # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
40
+
volumes:
41
+
#- /etc/OpenCL:/etc/OpenCL:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
42
+
#- /usr/lib/aarch64-linux-gnu/libmali.so.1:/usr/lib/aarch64-linux-gnu/libmali.so.1:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
43
+
44
+
vaapi:
45
+
devices:
46
+
- /dev/dri:/dev/dri
47
+
48
+
vaapi-wsl: # use this for VAAPI if you're running Immich in WSL2
49
+
devices:
50
+
- /dev/dri:/dev/dri
51
+
- /dev/dxg:/dev/dxg
52
+
volumes:
53
+
- /usr/lib/wsl:/usr/lib/wsl
54
+
environment:
55
+
- LIBVA_DRIVER_NAME=d3d12
+10
docker/fant0mib0t/kiwix/docker-compose.yml
+10
docker/fant0mib0t/kiwix/docker-compose.yml
+662
docker/fant0mib0t/tranquill-pds/config.toml
+662
docker/fant0mib0t/tranquill-pds/config.toml
···
1
+
[server]
2
+
# Public hostname of the PDS, such as `pds.example.com`.
3
+
#
4
+
# Can also be specified via environment variable `PDS_HOSTNAME`.
5
+
#
6
+
# Required! This value must be specified.
7
+
hostname = "pds.fantomitechno.dev"
8
+
9
+
# Address to bind the HTTP server to.
10
+
#
11
+
# Can also be specified via environment variable `SERVER_HOST`.
12
+
#
13
+
# Default value: "127.0.0.1"
14
+
host = "127.0.0.1"
15
+
16
+
# Port to bind the HTTP server to.
17
+
#
18
+
# Can also be specified via environment variable `SERVER_PORT`.
19
+
#
20
+
# Default value: 3000
21
+
22
+
# List of domains for user handles.
23
+
# Defaults to the PDS hostname when not set.
24
+
#
25
+
# Can also be specified via environment variable `PDS_USER_HANDLE_DOMAINS`.
26
+
#user_handle_domains =
27
+
28
+
# Enable PDS-hosted did:web identities. Hosting did:web requires a
29
+
# long-term commitment to serve DID documents; opt-in only.
30
+
#
31
+
# Can also be specified via environment variable `ENABLE_PDS_HOSTED_DID_WEB`.
32
+
#
33
+
# Default value: false
34
+
#enable_pds_hosted_did_web = false
35
+
36
+
# When set to true, skip age-assurance birthday prompt for all accounts.
37
+
#
38
+
# Can also be specified via environment variable `PDS_AGE_ASSURANCE_OVERRIDE`.
39
+
#
40
+
# Default value: false
41
+
age_assurance_override = true
42
+
43
+
# Require an invite code for new account registration.
44
+
#
45
+
# Can also be specified via environment variable `INVITE_CODE_REQUIRED`.
46
+
#
47
+
# Default value: true
48
+
invite_code_required = true
49
+
50
+
# Allow HTTP (non-TLS) proxy requests. Only useful during development.
51
+
#
52
+
# Can also be specified via environment variable `ALLOW_HTTP_PROXY`.
53
+
#
54
+
# Default value: false
55
+
#allow_http_proxy = false
56
+
57
+
# Disable all rate limiting. Should only be used in testing.
58
+
#
59
+
# Can also be specified via environment variable `DISABLE_RATE_LIMITING`.
60
+
#
61
+
# Default value: false
62
+
#disable_rate_limiting = false
63
+
64
+
# Skip the verified-comms-channel gate for login and record writes.
65
+
# Please keep this off unless you're an invite-only PDS!
66
+
#
67
+
# Can also be specified via environment variable `DISABLE_ACCOUNT_VERIFICATION_GATE`.
68
+
#
69
+
# Default value: false
70
+
#disable_account_verification_gate = false
71
+
72
+
# List of additional banned words for handle validation.
73
+
#
74
+
# Can also be specified via environment variable `PDS_BANNED_WORDS`.
75
+
#banned_words =
76
+
77
+
# URL to a privacy policy page.
78
+
#
79
+
# Can also be specified via environment variable `PRIVACY_POLICY_URL`.
80
+
#privacy_policy_url =
81
+
82
+
# URL to terms of service page.
83
+
#
84
+
# Can also be specified via environment variable `TERMS_OF_SERVICE_URL`.
85
+
#terms_of_service_url =
86
+
87
+
# Operator contact email address.
88
+
#
89
+
# Can also be specified via environment variable `CONTACT_EMAIL`.
90
+
contact_email = "me@fantomitechno.dev"
91
+
92
+
# Maximum allowed blob size in bytes (default 10 GiB).
93
+
#
94
+
# Can also be specified via environment variable `MAX_BLOB_SIZE`.
95
+
#
96
+
# Default value: 10737418240
97
+
#max_blob_size = 10737418240
98
+
99
+
# Maximum allowed number of preferences
100
+
#
101
+
# Can also be specified via environment variable `MAX_PREFERENCES_COUNT`.
102
+
#
103
+
# Default value: 1000
104
+
#max_preferences_count = 1000
105
+
106
+
# If you're not altering TLS config, you don't have to worry about this.
107
+
# This is the number of trusted reverse proxies in front of Tranquil.
108
+
# We read the client IP used for rate limiting and device records this many hops
109
+
# from the right of the X-Forwarded-For header.
110
+
# When left unset, Tranquil will assume:
111
+
# - 0, if the TLS termination is happening here on Tranquil via the TLS config
112
+
# - 1, if the TLS termination *isn't* happening here.
113
+
#
114
+
# Can also be specified via environment variable `TRUSTED_PROXY_COUNT`.
115
+
#trusted_proxy_count =
116
+
117
+
[server.tls]
118
+
# The path to the TLS cert chain.
119
+
# If you set both this and `key_path`, the server terminates TLS itself rather than expecting
120
+
# a reverse proxy to do it. The certificate and key reload on SIGHUP.
121
+
#
122
+
# Can also be specified via environment variable `TLS_CERT_PATH`.
123
+
#cert_path =
124
+
125
+
# Path to the TLS private key.
126
+
#
127
+
# Can also be specified via environment variable `TLS_KEY_PATH`.
128
+
#key_path =
129
+
130
+
# Serve HTTP/3 over QUIC on the same UDP port as the TCP listener.
131
+
# Requires cert_path and key_path.
132
+
#
133
+
# Can also be specified via environment variable `TLS_HTTP3`.
134
+
#
135
+
# Default value: false
136
+
#http3 = false
137
+
138
+
[frontend]
139
+
# Whether to enable the built in serving of the frontend.
140
+
#
141
+
# Can also be specified via environment variable `FRONTEND_ENABLED`.
142
+
#
143
+
# Default value: true
144
+
enabled = true
145
+
146
+
# Directory to serve as the frontend. The oauth_client_metadata.json will have any references to
147
+
# the frontend hostname replaced by the configured frontend hostname.
148
+
#
149
+
# Can also be specified via environment variable `FRONTEND_DIR`.
150
+
#
151
+
# Default value: "/var/lib/tranquil-pds/frontend"
152
+
#dir = "/var/lib/tranquil-pds/frontend"
153
+
154
+
[database]
155
+
# PostgreSQL connection URL.
156
+
#
157
+
# Can also be specified via environment variable `DATABASE_URL`.
158
+
#
159
+
# Required! This value must be specified.
160
+
#url =
161
+
162
+
# Maximum number of connections in the pool.
163
+
#
164
+
# Can also be specified via environment variable `DATABASE_MAX_CONNECTIONS`.
165
+
#
166
+
# Default value: 100
167
+
#max_connections = 100
168
+
169
+
# Minimum number of idle connections kept in the pool.
170
+
#
171
+
# Can also be specified via environment variable `DATABASE_MIN_CONNECTIONS`.
172
+
#
173
+
# Default value: 10
174
+
#min_connections = 10
175
+
176
+
# Timeout in seconds when acquiring a connection from the pool.
177
+
#
178
+
# Can also be specified via environment variable `DATABASE_ACQUIRE_TIMEOUT_SECS`.
179
+
#
180
+
# Default value: 10
181
+
#acquire_timeout_secs = 10
182
+
183
+
[secrets]
184
+
# Secret used for signing JWTs. Must be at least 32 characters in
185
+
# production.
186
+
#
187
+
# Can also be specified via environment variable `JWT_SECRET`.
188
+
#jwt_secret =
189
+
190
+
# Secret used for DPoP proof validation. Must be at least 32 characters
191
+
# in production.
192
+
#
193
+
# Can also be specified via environment variable `DPOP_SECRET`.
194
+
#dpop_secret =
195
+
196
+
# Master key used for key-encryption and HKDF derivation. Must be at
197
+
# least 32 characters in production.
198
+
#
199
+
# Can also be specified via environment variable `MASTER_KEY`.
200
+
#master_key =
201
+
202
+
# Optional operator-held PLC recovery key, as a public `did:key`. The PDS
203
+
# continues to sign PLC operations with the per-account signing key, which
204
+
# always remains in `rotationKeys`.
205
+
#
206
+
# Can also be specified via environment variable `PLC_ROTATION_KEY`.
207
+
#plc_rotation_key =
208
+
209
+
# Allow insecure/test secrets. NEVER enable in production.
210
+
#
211
+
# Can also be specified via environment variable `TRANQUIL_PDS_ALLOW_INSECURE_SECRETS`.
212
+
#
213
+
# Default value: false
214
+
#allow_insecure = false
215
+
216
+
[storage]
217
+
# Storage backend: `filesystem` or `s3`.
218
+
#
219
+
# Can also be specified via environment variable `BLOB_STORAGE_BACKEND`.
220
+
#
221
+
# Default value: "filesystem"
222
+
#backend = "filesystem"
223
+
224
+
# Path on disk for the filesystem blob backend.
225
+
#
226
+
# Can also be specified via environment variable `BLOB_STORAGE_PATH`.
227
+
#
228
+
# Default value: "/var/lib/tranquil-pds/blobs"
229
+
#path = "/var/lib/tranquil-pds/blobs"
230
+
231
+
# S3 bucket name for blob storage.
232
+
#
233
+
# Can also be specified via environment variable `S3_BUCKET`.
234
+
#s3_bucket =
235
+
236
+
# Custom S3 endpoint URL.
237
+
#
238
+
# Can also be specified via environment variable `S3_ENDPOINT`.
239
+
#s3_endpoint =
240
+
241
+
# Repository backend: `postgres` by default, or `tranquil-store`, our embedded db.
242
+
# tranquil-store is EXPERIMENTAL!!!! RISK OF TOTAL DATA LOSS.
243
+
#
244
+
# Can also be specified via environment variable `REPO_BACKEND`.
245
+
#
246
+
# Default value: "postgres"
247
+
#repo_backend = "postgres"
248
+
249
+
[tranquil_store]
250
+
# Directory for tranquil-store data: the metastore, eventlog, and blockstore.
251
+
#
252
+
# Can also be specified via environment variable `TRANQUIL_STORE_DATA_DIR`.
253
+
#
254
+
# Default value: "/var/lib/tranquil-pds/store"
255
+
#data_dir = "/var/lib/tranquil-pds/store"
256
+
257
+
# Fjall block cache size in megabytes. Defaults to 20% of system RAM when unset.
258
+
#
259
+
# Can also be specified via environment variable `TRANQUIL_STORE_MEMORY_BUDGET_MB`.
260
+
#memory_budget_mb =
261
+
262
+
# Number of handler threads. Defaults to available_parallelism / 2.
263
+
#
264
+
# Can also be specified via environment variable `TRANQUIL_STORE_HANDLER_THREADS`.
265
+
#handler_threads =
266
+
267
+
# Maximum total bytes of pending (unsynced) eventlog payloads. Appenders block
268
+
# once this budget is exhausted until in-flight events drain via fsync. Set to
269
+
# 0 to disable backpressure. Default: 1 GiB.
270
+
#
271
+
# Can also be specified via environment variable `TRANQUIL_STORE_EVENTLOG_PENDING_BYTES_BUDGET`.
272
+
#
273
+
# Default value: 1073741824
274
+
#eventlog_pending_bytes_budget = 1073741824
275
+
276
+
# Maximum size of an individual eventlog payload in bytes. Single events
277
+
# larger than this are rejected at append time. Default: 256 MiB.
278
+
#
279
+
# Can also be specified via environment variable `TRANQUIL_STORE_EVENTLOG_MAX_EVENT_PAYLOAD`.
280
+
#
281
+
# Default value: 268435456
282
+
#eventlog_max_event_payload = 268435456
283
+
284
+
# Maximum size of an individual blockstore data file in bytes. When the
285
+
# active data file reaches this size it is rolled over and becomes
286
+
# eligible for compaction. Default: 256 MiB.
287
+
#
288
+
# Can also be specified via environment variable `TRANQUIL_STORE_MAX_BLOCKSTORE_FILE_SIZE`.
289
+
#
290
+
# Default value: 268435456
291
+
#max_blockstore_file_size = 268435456
292
+
293
+
# Maximum size of an individual eventlog segment file in bytes. When the
294
+
# active segment reaches this size it is sealed and a new one is created.
295
+
# Safe to change on a running instance. Default: 256 MiB.
296
+
#
297
+
# Can also be specified via environment variable `TRANQUIL_STORE_MAX_EVENTLOG_SEGMENT_SIZE`.
298
+
#
299
+
# Default value: 268435456
300
+
#max_eventlog_segment_size = 268435456
301
+
302
+
[cache]
303
+
# Cache backend: `ripple` by default, or `valkey`.
304
+
#
305
+
# Can also be specified via environment variable `CACHE_BACKEND`.
306
+
#
307
+
# Default value: "ripple"
308
+
#backend = "ripple"
309
+
310
+
# Valkey / Redis connection URL. Required when `backend = "valkey"`.
311
+
#
312
+
# Can also be specified via environment variable `VALKEY_URL`.
313
+
#valkey_url =
314
+
315
+
[cache.ripple]
316
+
# Address to bind the Ripple gossip protocol listener. With the default
317
+
# value and no cluster_key or peers configured, the listener binds
318
+
# loopback instead and runs as a single node.
319
+
#
320
+
# Can also be specified via environment variable `RIPPLE_BIND`.
321
+
#
322
+
# Default value: "0.0.0.0:0"
323
+
#bind_addr = "0.0.0.0:0"
324
+
325
+
# List of seed peer addresses.
326
+
#
327
+
# Can also be specified via environment variable `RIPPLE_PEERS`.
328
+
#peers =
329
+
330
+
# Unique machine identifier. Auto-derived from hostname when not set.
331
+
#
332
+
# Can also be specified via environment variable `RIPPLE_MACHINE_ID`.
333
+
#machine_id =
334
+
335
+
# Gossip protocol interval in milliseconds.
336
+
#
337
+
# Can also be specified via environment variable `RIPPLE_GOSSIP_INTERVAL_MS`.
338
+
#
339
+
# Default value: 200
340
+
#gossip_interval_ms = 200
341
+
342
+
# Maximum cache size in megabytes.
343
+
#
344
+
# Can also be specified via environment variable `RIPPLE_CACHE_MAX_MB`.
345
+
#
346
+
# Default value: 256
347
+
#cache_max_mb = 256
348
+
349
+
# Pre-shared cluster key authenticating ripple peers. Every node in the
350
+
# cluster must set the same value. When unset, peers are unauthenticated.
351
+
#
352
+
# Can also be specified via environment variable `RIPPLE_CLUSTER_KEY`.
353
+
#cluster_key =
354
+
355
+
# Allow ripple to bind a non-loopback address without a cluster key.
356
+
# Peers will be unauthenticated. Intended for trusted private networks.
357
+
#
358
+
# Can also be specified via environment variable `RIPPLE_ALLOW_INSECURE`.
359
+
#
360
+
# Default value: false
361
+
#allow_insecure = false
362
+
363
+
[plc]
364
+
# Base URL of the PLC directory.
365
+
#
366
+
# Can also be specified via environment variable `PLC_DIRECTORY_URL`.
367
+
#
368
+
# Default value: "https://plc.directory"
369
+
#directory_url = "https://plc.directory"
370
+
371
+
# HTTP request timeout in seconds.
372
+
#
373
+
# Can also be specified via environment variable `PLC_TIMEOUT_SECS`.
374
+
#
375
+
# Default value: 10
376
+
#timeout_secs = 10
377
+
378
+
# TCP connect timeout in seconds.
379
+
#
380
+
# Can also be specified via environment variable `PLC_CONNECT_TIMEOUT_SECS`.
381
+
#
382
+
# Default value: 5
383
+
#connect_timeout_secs = 5
384
+
385
+
# Seconds to cache DID documents in memory.
386
+
#
387
+
# Can also be specified via environment variable `DID_CACHE_TTL_SECS`.
388
+
#
389
+
# Default value: 300
390
+
#did_cache_ttl_secs = 300
391
+
392
+
[firehose]
393
+
# Size of the in-memory broadcast buffer for firehose events.
394
+
#
395
+
# Can also be specified via environment variable `FIREHOSE_BUFFER_SIZE`.
396
+
#
397
+
# Default value: 10000
398
+
#buffer_size = 10000
399
+
400
+
# How many hours of historical events to replay for cursor-based
401
+
# firehose connections.
402
+
#
403
+
# Can also be specified via environment variable `FIREHOSE_BACKFILL_HOURS`.
404
+
#
405
+
# Default value: 72
406
+
#backfill_hours = 72
407
+
408
+
# Maximum concurrent full-repo exports, eg. getRepo without `since`.
409
+
#
410
+
# Can also be specified via environment variable `MAX_CONCURRENT_REPO_EXPORTS`.
411
+
#
412
+
# Default value: 4
413
+
#max_concurrent_repo_exports = 4
414
+
415
+
# List of relay / crawler notification URLs.
416
+
#
417
+
# Can also be specified via environment variable `CRAWLERS`.
418
+
#crawlers =
419
+
420
+
[email]
421
+
# Sender email address. When unset, email sending is disabled.
422
+
#
423
+
# Can also be specified via environment variable `MAIL_FROM_ADDRESS`.
424
+
from_address = "me@no-reply.fantomitechno.dev"
425
+
426
+
# Display name used in the `From` header.
427
+
#
428
+
# Can also be specified via environment variable `MAIL_FROM_NAME`.
429
+
#
430
+
# Default value: "Tranquil PDS"
431
+
#from_name = "Tranquil PDS"
432
+
433
+
# HELO/EHLO name announced to remote SMTP servers. Applies to both
434
+
# smarthost and direct-MX modes. Defaults to the server hostname.
435
+
#
436
+
# Can also be specified via environment variable `MAIL_HELO_NAME`.
437
+
#helo_name =
438
+
439
+
[email.smarthost]
440
+
# SMTP relay host. When set, mail is delivered through this host
441
+
# instead of resolving recipient MX records directly.
442
+
#
443
+
# environment variable `MAIL_SMARTHOST_HOST`.
444
+
445
+
# SMTP relay port.
446
+
#
447
+
# environment variable `MAIL_SMARTHOST_PORT`.
448
+
449
+
# SMTP authentication username.
450
+
#
451
+
# environment variable `MAIL_SMARTHOST_USERNAME`.
452
+
453
+
# SMTP authentication password.
454
+
#
455
+
# environment variable `MAIL_SMARTHOST_PASSWORD`.
456
+
457
+
# TLS mode. Valid values: "implicit", "starttls", "none". Setting "none"
458
+
# alongside a password is rejected at startup to prevent transmitting
459
+
# credentials in plaintext.
460
+
#
461
+
# Can also be specified via environment variable `MAIL_SMARTHOST_TLS`.
462
+
#
463
+
# Default value: "starttls"
464
+
#tls = "starttls"
465
+
466
+
# Max size of the connection pool.
467
+
#
468
+
# Can also be specified via environment variable `MAIL_SMARTHOST_POOL_SIZE`.
469
+
#
470
+
# Default value: 4
471
+
#pool_size = 4
472
+
473
+
# Per-command SMTP timeout in seconds. Bounds the security handshake.
474
+
#
475
+
# Can also be specified via environment variable `MAIL_SMARTHOST_COMMAND_TIMEOUT_SECS`.
476
+
#
477
+
# Default value: 30
478
+
#command_timeout_secs = 30
479
+
480
+
# Total per-message timeout in seconds. Wraps the entire send so a
481
+
# stuck relay cannot stall the comms queue.
482
+
#
483
+
# Can also be specified via environment variable `MAIL_SMARTHOST_TOTAL_TIMEOUT_SECS`.
484
+
#
485
+
# Default value: 60
486
+
#total_timeout_secs = 60
487
+
488
+
[email.direct_mx]
489
+
# Per-command SMTP timeout in seconds.
490
+
#
491
+
# Can also be specified via environment variable `MAIL_COMMAND_TIMEOUT_SECS`.
492
+
#
493
+
# Default value: 30
494
+
#command_timeout_secs = 30
495
+
496
+
# Total per-message timeout across all MX attempts in seconds.
497
+
#
498
+
# Can also be specified via environment variable `MAIL_TOTAL_TIMEOUT_SECS`.
499
+
#
500
+
# Default value: 60
501
+
#total_timeout_secs = 60
502
+
503
+
# Max number of concurrent direct-MX sends. Limits the load placed
504
+
# on any single recipient MX during a backlog drain.
505
+
#
506
+
# Can also be specified via environment variable `MAIL_MAX_CONCURRENT_SENDS`.
507
+
#
508
+
# Default value: 8
509
+
#max_concurrent_sends = 8
510
+
511
+
# Require STARTTLS on every MX hop. When false, TLS is
512
+
# attempted opportunistically and the session falls back to plaintext
513
+
# if the remote does not advertise STARTTLS. Set true to refuse
514
+
# plaintext delivery, at the cost of failing sends to MX hosts that
515
+
# do not support TLS.
516
+
#
517
+
# Can also be specified via environment variable `MAIL_REQUIRE_TLS`.
518
+
#
519
+
# Default value: false
520
+
#require_tls = false
521
+
522
+
[email.dkim]
523
+
# DKIM selector. When unset, outgoing mail is not signed.
524
+
#
525
+
# Can also be specified via environment variable `MAIL_DKIM_SELECTOR`.
526
+
#selector =
527
+
528
+
# DKIM signing domain.
529
+
#
530
+
# Can also be specified via environment variable `MAIL_DKIM_DOMAIN`.
531
+
#domain =
532
+
533
+
# Path to the DKIM private key in PEM format. Supports RSA and
534
+
# Ed25519 keys.
535
+
#
536
+
# Can also be specified via environment variable `MAIL_DKIM_KEY_PATH`.
537
+
#private_key_path =
538
+
539
+
[notifications]
540
+
# Polling interval in milliseconds for the comms queue.
541
+
#
542
+
# Can also be specified via environment variable `NOTIFICATION_POLL_INTERVAL_MS`.
543
+
#
544
+
# Default value: 1000
545
+
#poll_interval_ms = 1000
546
+
547
+
# Number of notifications to process per batch.
548
+
#
549
+
# Can also be specified via environment variable `NOTIFICATION_BATCH_SIZE`.
550
+
#
551
+
# Default value: 100
552
+
#batch_size = 100
553
+
554
+
[moderation]
555
+
# External report-handling service URL.
556
+
#
557
+
# Can also be specified via environment variable `REPORT_SERVICE_URL`.
558
+
#report_service_url =
559
+
560
+
# DID of the external report-handling service.
561
+
#
562
+
# Can also be specified via environment variable `REPORT_SERVICE_DID`.
563
+
#report_service_did =
564
+
565
+
[import]
566
+
# Whether the PDS accepts repo imports.
567
+
#
568
+
# Can also be specified via environment variable `ACCEPTING_REPO_IMPORTS`.
569
+
#
570
+
# Default value: true
571
+
#accepting = true
572
+
573
+
# Maximum allowed import archive size in bytes (default 1 GiB).
574
+
#
575
+
# Can also be specified via environment variable `MAX_IMPORT_SIZE`.
576
+
#
577
+
# Default value: 1073741824
578
+
#max_size = 1073741824
579
+
580
+
# Maximum number of blocks allowed in an import.
581
+
#
582
+
# Can also be specified via environment variable `MAX_IMPORT_BLOCKS`.
583
+
#
584
+
# Default value: 500000
585
+
#max_blocks = 500000
586
+
587
+
# Skip CAR verification during import. Only for development/debugging.
588
+
#
589
+
# Can also be specified via environment variable `SKIP_IMPORT_VERIFICATION`.
590
+
#
591
+
# Default value: false
592
+
#skip_verification = false
593
+
594
+
[scheduled]
595
+
# Interval in seconds between scheduled delete checks.
596
+
#
597
+
# Can also be specified via environment variable `SCHEDULED_DELETE_CHECK_INTERVAL_SECS`.
598
+
#
599
+
# Default value: 3600
600
+
#delete_check_interval_secs = 3600
601
+
602
+
# Interval in seconds between data file compaction scans (tranquil-store only).
603
+
# Set to 0 to disable.
604
+
#
605
+
# Can also be specified via environment variable `COMPACTION_INTERVAL_SECS`.
606
+
#
607
+
# Default value: 3600
608
+
#compaction_interval_secs = 3600
609
+
610
+
# Liveness ratio threshold below which a data file is compacted (0.0-1.0).
611
+
#
612
+
# Can also be specified via environment variable `COMPACTION_LIVENESS_THRESHOLD`.
613
+
#
614
+
# Default value: 0.7
615
+
#compaction_liveness_threshold = 0.7
616
+
617
+
# Grace period in milliseconds before a zero-refcount block can be removed by compaction.
618
+
#
619
+
# Can also be specified via environment variable `COMPACTION_GRACE_PERIOD_MS`.
620
+
#
621
+
# Default value: 600000
622
+
#compaction_grace_period_ms = 600000
623
+
624
+
# Interval in seconds between reachability walk runs (tranquil-store only).
625
+
# Set to 0 to disable. Default: weekly.
626
+
#
627
+
# Can also be specified via environment variable `REACHABILITY_WALK_INTERVAL_SECS`.
628
+
#
629
+
# Default value: 604800
630
+
#reachability_walk_interval_secs = 604800
631
+
632
+
# Interval in seconds between continuous archival passes (tranquil-store only).
633
+
# Sealed eventlog segments are copied to the archival destination each tick.
634
+
# Set to 0 to disable. Default: 60 seconds.
635
+
#
636
+
# Can also be specified via environment variable `ARCHIVAL_INTERVAL_SECS`.
637
+
#
638
+
# Default value: 60
639
+
#archival_interval_secs = 60
640
+
641
+
# Archival destination directory for sealed eventlog segments.
642
+
# If unset, archival is disabled.
643
+
#
644
+
# Can also be specified via environment variable `ARCHIVAL_DEST_DIR`.
645
+
#archival_dest_dir =
646
+
647
+
# Maximum age of events retained in the eventlog before pruning.
648
+
# Per the atproto firehose spec, the relay backfill window only needs
649
+
# to cover "hours or days".
650
+
#
651
+
# Can also be specified via environment variable `EVENT_RETENTION_MAX_AGE_SECS`.
652
+
#
653
+
# Default value: 604800
654
+
#event_retention_max_age_secs = 604800
655
+
656
+
# Interval in seconds between event retention prune passes.
657
+
# Set to 0 to disable.
658
+
#
659
+
# Can also be specified via environment variable `EVENT_RETENTION_INTERVAL_SECS`.
660
+
#
661
+
# Default value: 3600
662
+
#event_retention_interval_secs = 3600
+52
docker/fant0mib0t/tranquill-pds/docker-compose.yml
+52
docker/fant0mib0t/tranquill-pds/docker-compose.yml
···
1
+
services:
2
+
tranquil-pds:
3
+
image: atcr.io/tranquil.farm/tranquil-pds:91999819c616afbb26586dce4e1ab70f767684de
4
+
# tag: 0.6.5
5
+
restart: unless-stopped
6
+
environment:
7
+
SERVER_HOST: "[::]"
8
+
ports:
9
+
- "127.0.0.1:6166:3000"
10
+
volumes:
11
+
- ./config.toml:/etc/tranquil-pds/config.toml:ro
12
+
# In memory of @olaren.dev's blobs when lewis forgot to update /tranquil to /tranquil-pds :(
13
+
- /nas/tranquil-pds/blob:/var/lib/tranquil-pds/blobs
14
+
- /nas/tranquil-pds/store:/var/lib/tranquil-pds/store
15
+
env_file:
16
+
- .env
17
+
depends_on:
18
+
db:
19
+
condition: service_healthy
20
+
healthcheck:
21
+
test: ["CMD", "/usr/local/bin/tranquil-pds", "healthcheck"]
22
+
interval: 30s
23
+
timeout: 10s
24
+
retries: 3
25
+
start_period: 10s
26
+
deploy:
27
+
resources:
28
+
limits:
29
+
memory: 1G
30
+
reservations:
31
+
memory: 256M
32
+
33
+
db:
34
+
image: postgres:18-alpine
35
+
restart: unless-stopped
36
+
env_file:
37
+
- .env
38
+
volumes:
39
+
# In memory of @mrrp.lol when Lewis had "/data" here and the account got nuked on restart including rotation key :(
40
+
- /nas/tranquil-pds/pg_data:/var/lib/postgresql
41
+
healthcheck:
42
+
test: ["CMD-SHELL", "pg_isready -U tranquil_pds -d pds"]
43
+
interval: 10s
44
+
timeout: 5s
45
+
retries: 5
46
+
start_period: 10s
47
+
deploy:
48
+
resources:
49
+
limits:
50
+
memory: 512M
51
+
reservations:
52
+
memory: 128M
+1
-6
flake.nix
+1
-6
flake.nix
···
49
49
inputs.lucide-src.follows = "";
50
50
inputs.mermaid-src.follows = "";
51
51
};
52
-
53
-
inputs.tranquil = {
54
-
url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
55
-
inputs.nixpkgs.follows = "nixpkgs";
56
-
};
57
52
};
58
53
59
54
outputs =
···
100
95
fantomitechno-msi = commonSystem "msi";
101
96
102
97
# Servers
103
-
conseil = commonSystem "conseil";
98
+
Conseil = commonSystem "conseil";
104
99
fant0mib0t = commonSystem "fant0mib0t";
105
100
106
101
# Installer
+4
-1
modules/codium/settings.json
+4
-1
modules/codium/settings.json
···
49
49
"https://github.com": true
50
50
},
51
51
"editor.fontFamily": "'JetBrainsMono Nerd Font Propo', monospace",
52
-
"clangd.path": "/home/fantomitechno/.config/VSCodium/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/22.1.0/clangd_22.1.0/bin/clangd"
52
+
"clangd.path": "/home/fantomitechno/.config/VSCodium/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/22.1.0/clangd_22.1.0/bin/clangd",
53
+
"[markdown]": {
54
+
"editor.defaultFormatter": "esbenp.prettier-vscode"
55
+
}
53
56
}