Containerized Seafile Deployment

A fully containerized deployment of Seafile for Docker and Docker Swarm.

Table of Contents

1. Features
2. Structure
3. Getting Started
4. Additional Information

Features

• Complete redesign of the official Docker deployment with containerization best-practices in mind.
• Runs seahub (frontend) and seafile server (backend) in separate containers, which commuicate with each other over TCP.
• Cluster without pro edition.
• Completely removed Nginx and self-implemented Let's Encrypt and replaced it with two caddy services.
• Increased Security:
  • The caddy reverse proxy serves as a single entry point to the stack. Everything else runs in an isolated network.
  • Using Alpine Linux based images for the frontend, which is designed with security in mind and comes with proactive security features.
  • Official Seafile Docker deployment uses entirely outdated base images and dependencies. Here base images and dependencies are updated on a regular basis.
• Reworked Dockerfiles featuring multi-stage builds, allowing for smaller images and faster builds.
• Schedule offline garbage collection with cron job.
• Runs upgrade scripts automatically when a new image version is deployed.
• All features of Seafile Community Edition are included.

Structure

Services:

• seafile-server
  • contains the backend component called seafile-server
  • handles storage, some direct client access and seafdav
• seahub
  • dynamic frontend component called seahub
  • serves the web-ui
  • communicates with seafile-server
• seahub-media
  • serves static website content as well as avatars and custom logos
• db
  • the database used by seafile-server and seahub
• memcached
  • database cache for seahub
• seafile-caddy
  • reverse proxy that forwards paths to the correct endpoints: seafile-server, seahub or seahub-media
  • is the single external entrypoint to the deployment

Volumes:

• seafile-data
  • shared data volume of seafile-server and seahub
  • also contains configuration and log files
• seafile-mariadb
  • volume of the db service
  • stores the database
• seahub-custom
  • contains custom logos
  • stored by seahub and served by seahub-media
• seahub-avatars
  • contains user avatars
  • stored by seahub and served by seahub-media

Note: In the official docker deployment custom and avatars are served by nginx. Seahub alone is not able to serve them for some reason, hence the separate volumes.

Networks:

• seafile-net
  • isolated local network used by the services to communicate with each other

Getting Started

1. Prerequisites

   Requires Docker and docker-compose to be installed.

2. Get the compose file

   Docker Compose

   Use this compose file as a starting point.

   wget https://raw.githubusercontent.com/ggogel/seafile-containerized/master/compose/docker-compose.yml
   

   Note: We expect certain services names. Do not rename services except db.

   Docker Swarm

   If you run a single node swarm and don't want to run multiple replicas, you can use the same compose file. Otherwise refer to Additional Information / Docker Swarm.

3. Set environment variables

   Important: The environment variables are only relevant for the first deployment. Existing configuration in the volumes is not overwritten.

   On a first deployment you need to carefully set those values. Changing them later can be tricky. Refer to the Seafile documentation on how to change configuration values.

   seafile-server

   The name of the mariadb service, which is automatically the docker-internal hostname.

   - DB_HOST=db 
   

   Password of the mariadb root user. This must equal MYSQL_ROOT_PASSWORD.

   - DB_ROOT_PASSWD=db_dev
   

   Time zone used by Seafile.

   - TIME_ZONE=Europe/Berlin
   

   This will be used for the SERVICE_URL and FILE_SERVER_ROOT. Important: Changing those values in the config files later won't have any effect because they are written to the database. Those values have priority over the config files. To change them enter the "System Admin" section on the web-ui. If you encounter issues with file upload, it's likely that those are configured incorrectly.

   - SEAFILE_SERVER_HOSTNAME=seafile.mydomain.com 
   

   If you plan to use a reverse proxy with https, set this to true. This will replace http with https in the SERVICE_URL and FILE_SERVER_ROOT.

   - HTTPS=false
   

   seahub

   Username / E-Mail of the first admin user.

   - SEAFILE_ADMIN_EMAIL=me@example.com
   

   Password of the first admin user.

   - SEAFILE_ADMIN_PASSWORD=asecret
   

   db

   Password of the mariadb root user. Must match DB_ROOT_PASSWD.

   - MYSQL_ROOT_PASSWORD=db_dev
   

   Enable logging console.

   - MYSQL_LOG_CONSOLE=true
   

4. (Optional) Migrating volumes from official Docker deployment or native install

   If you set up Seafile from scratch you can skip this part.

   The official Docker deployment uses bind mounts to the host path instead of actual docker volumes. This was probably chosen to create compatibility between a native install and the docker deployment. This deployment uses named volumes, which come with several advantages over bind mounts and are the recommended mechanism for persisted storage on Docker. The default path for named volumes on Docker is /var/lib/docker/volumes/PROJECT-NAME_VOLUME-NAME/_data. Of course you could also use the old paths but it is not best practice according to the Docker documentation.

   To migrate storage from the official Docker deployment run:

   mkdir -p /var/lib/docker/volumes/seafile_seafile-data/_data
   mkdir -p /var/lib/docker/volumes/seafile_seafile-mariadb/_data
   mkdir -p /var/lib/docker/volumes/seafile_seahub-custom/_data
   mkdir -p /var/lib/docker/volumes/seafile_seahub-avatars/_data
   
   cp -r /opt/seafile-data /var/lib/docker/volumes/seafile_seafile-data/_data
   cp -r /opt/seafile-mysql/db /var/lib/docker/volumes/seafile_seafile-mariadb/_data
   mv /var/lib/docker/volumes/seafile_seafile-data/_data/seafile/seahub-data/custom /var/lib/docker/volumes/seafile_seahub-custom/_data
   mv /var/lib/docker/volumes/seafile_seafile-data/_data/seafile/seahub-data/avatars /var/lib/docker/volumes/seafile_seahub-avatars/_data
   
   

   Tip: If you want to use a different path, like a separate drive, to store your Docker volumes, simply create a symbolic link like this:

   service docker stop
   mv /var/lib/docker/volumes /var/lib/docker/volumes-bak
   mkdir -p /mnt/external/volumes
   ln -sf /mnt/external/volumes /var/lib/docker
   service docker start
   

5. (Optional) Reverse Proxy

   The caddy reverse proxy integrated with the deployment exposes port 80. Point your existing reverse proxy to that port.

   This deployment does by design not include a reverse proxy capable of HTTPS and Let's Encrypt, unlike the official deployment, because usually Docker users already have some docker-based reverse proxy solution deployed, which does exactly that.

6. Deployment

   Docker Compose

   After you followed the above steps and you have configured everything correctly run:

   docker-compose -p seafile up -d
   

   Docker Swarm

   After you followed the above steps and you have configured everything correctly run:

   docker stack deploy -c docker-compose.yml seafile
   

Advanced Configuration and Troubleshooting

For advanced configuration and troubleshooting see the Wiki.