mirror of
https://github.com/lfnovo/open-notebook.git
synced 2026-07-25 23:56:36 +00:00
fc3f35a4fa
* fix: bind SurrealDB's docker-compose port to localhost only The surrealdb service published 8000:8000, exposing it on 0.0.0.0 - reachable from the network with the default root:root credentials. The open_notebook service reaches it over the internal compose network regardless, so the host port mapping is purely for local debugging (Surrealist, `surreal sql`). Bind it to 127.0.0.1 instead. * chore: add gitignored compose override for host-specific tweaks The port bind is now localhost-only by default; ship a docker-compose.override.yml.example (and gitignore the real override, which docker compose auto-merges) so users who genuinely need remote DB access have a sanctioned, secure-by-default way to re-expose it instead of editing the tracked compose file. --------- Co-authored-by: Luis Novo <lfnovo@gmail.com>
47 lines
1.9 KiB
YAML
47 lines
1.9 KiB
YAML
services:
|
|
surrealdb:
|
|
image: surrealdb/surrealdb:v2
|
|
# Credentials default to root:root for a zero-config local setup. Before
|
|
# exposing this instance to a network, set SURREAL_USER / SURREAL_PASSWORD
|
|
# in a .env file (see .env.example) — they are applied here and to the
|
|
# open_notebook service below, so the two always stay in sync.
|
|
command: start --log info --user ${SURREAL_USER:-root} --pass ${SURREAL_PASSWORD:-root} rocksdb:/mydata/mydatabase.db
|
|
user: root # Required for bind mounts on Linux
|
|
ports:
|
|
# Bound to localhost only: the open_notebook service reaches this over
|
|
# the internal compose network regardless, so the host port is purely
|
|
# for local debugging (e.g. Surrealist, `surreal sql`). Exposing this
|
|
# on 0.0.0.0 would let anyone who can reach the host connect with the
|
|
# default root:root credentials.
|
|
- "127.0.0.1:8000:8000"
|
|
volumes:
|
|
- ./surreal_data:/mydata
|
|
environment:
|
|
- SURREAL_EXPERIMENTAL_GRAPHQL=true
|
|
restart: always
|
|
pull_policy: always
|
|
|
|
open_notebook:
|
|
image: lfnovo/open_notebook:v1-latest
|
|
ports:
|
|
- "8502:8502" # Web UI
|
|
- "5055:5055" # REST API
|
|
environment:
|
|
# REQUIRED: Change this to your own secret string
|
|
# This encrypts your API keys in the database
|
|
- OPEN_NOTEBOOK_ENCRYPTION_KEY=change-me-to-a-secret-string
|
|
|
|
# Database connection. SURREAL_USER / SURREAL_PASSWORD default to root:root
|
|
# for local use; override them in a .env file before exposing the instance
|
|
# (the same values configure the surrealdb service above).
|
|
- SURREAL_URL=ws://surrealdb:8000/rpc
|
|
- SURREAL_USER=${SURREAL_USER:-root}
|
|
- SURREAL_PASSWORD=${SURREAL_PASSWORD:-root}
|
|
- SURREAL_NAMESPACE=open_notebook
|
|
- SURREAL_DATABASE=open_notebook
|
|
volumes:
|
|
- ./notebook_data:/app/data
|
|
depends_on:
|
|
- surrealdb
|
|
restart: always
|
|
pull_policy: always
|