vxaboveground/overlord
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

hopefully get this working first try

Browse Source
This commit is contained in:
KingKDot
2026-03-07 15:14:00 -06:00
parent d26668df78
commit 4053293ccb
12 changed files with 496 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/docker-publish.yml
+22
View File
@@ -77,8 +77,25 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Check if version image already exists
id: existence
shell: bash
run: |
set -euo pipefail
image="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
version="${{ steps.srcver.outputs.version }}"
if docker buildx imagetools inspect "${image}:${version}" >/dev/null 2>&1; then
echo "Image already exists for version ${version}; skipping publish."
echo "should_push=false" >> "$GITHUB_OUTPUT"
else
echo "No image found for version ${version}; publishing enabled."
echo "should_push=true" >> "$GITHUB_OUTPUT"
fi
- name: Extract metadata
id: meta
if: steps.existence.outputs.should_push == 'true'
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -89,6 +106,7 @@ jobs:
type=raw,value=latest
- name: Build and push server image
if: steps.existence.outputs.should_push == 'true'
uses: docker/build-push-action@v5
with:
context: .
@@ -99,3 +117,7 @@ jobs:
cache-from: type=gha
cache-to: type=gha,mode=max
platforms: linux/amd64,linux/arm64
- name: Publish skipped
if: steps.existence.outputs.should_push != 'true'
run: echo "Docker image push skipped because this version already exists in GHCR."
.gitignore
+3 -1
View File
@@ -45,4 +45,6 @@ plugin-sample-go/*.zip
Overlord-Server/data/
# Release packaging output
release/
release/
stress/
Overlord-Server/config.json.example
+9 -1
View File
@@ -11,7 +11,15 @@
"tls": {
"certPath": "./certs/server.crt",
"keyPath": "./certs/server.key",
"caPath": ""
"caPath": "",
"certbot": {
"enabled": false,
"livePath": "/etc/letsencrypt/live",
"domain": "",
"certFileName": "fullchain.pem",
"keyFileName": "privkey.pem",
"caFileName": "chain.pem"
}
},
"notifications": {
"keywords": ["bank", "password", "admin"],
Overlord-Server/public/assets/settings.js
+110
View File
@@ -36,8 +36,19 @@ const securityRequireLowercaseInput = document.getElementById("security-require-
const securityRequireNumberInput = document.getElementById("security-require-number");
const securityRequireSymbolInput = document.getElementById("security-require-symbol");
const tlsForm = document.getElementById("tls-form");
const tlsPermissionNote = document.getElementById("tls-permission-note");
const tlsSaveBtn = document.getElementById("tls-save-btn");
const tlsCertbotEnabledInput = document.getElementById("tls-certbot-enabled");
const tlsCertbotLivePathInput = document.getElementById("tls-certbot-live-path");
const tlsCertbotDomainInput = document.getElementById("tls-certbot-domain");
const tlsCertbotCertFileInput = document.getElementById("tls-certbot-cert-file");
const tlsCertbotKeyFileInput = document.getElementById("tls-certbot-key-file");
const tlsCertbotCaFileInput = document.getElementById("tls-certbot-ca-file");
let currentUser = null;
let securityConfig = null;
let tlsConfig = null;
function showMessage(text, type = "ok") {
if (!messageEl) return;
@@ -123,6 +134,23 @@ function setSecurityFormDisabled(disabled) {
}
}
function setTlsFormDisabled(disabled) {
const controls = [
tlsCertbotEnabledInput,
tlsCertbotLivePathInput,
tlsCertbotDomainInput,
tlsCertbotCertFileInput,
tlsCertbotKeyFileInput,
tlsCertbotCaFileInput,
tlsSaveBtn,
];
for (const control of controls) {
if (!control) continue;
control.disabled = disabled;
}
}
function applySecurityForm() {
if (!securityConfig) return;
securitySessionTtlInput.value = String(securityConfig.sessionTtlHours || 168);
@@ -169,6 +197,50 @@ async function loadSecurityPolicy() {
setSecurityFormDisabled(false);
}
function applyTlsForm() {
const certbot = tlsConfig?.certbot || {};
tlsCertbotEnabledInput.checked = Boolean(certbot.enabled);
tlsCertbotLivePathInput.value = certbot.livePath || "/etc/letsencrypt/live";
tlsCertbotDomainInput.value = certbot.domain || "";
tlsCertbotCertFileInput.value = certbot.certFileName || "fullchain.pem";
tlsCertbotKeyFileInput.value = certbot.keyFileName || "privkey.pem";
tlsCertbotCaFileInput.value = certbot.caFileName || "chain.pem";
}
async function loadTlsSettings() {
if (!currentUser) return;
if (!isAdmin(currentUser.role)) {
tlsPermissionNote.classList.remove("hidden");
setTlsFormDisabled(true);
tlsConfig = {
certbot: {
enabled: false,
livePath: "/etc/letsencrypt/live",
domain: "",
certFileName: "fullchain.pem",
keyFileName: "privkey.pem",
caFileName: "chain.pem",
},
};
applyTlsForm();
return;
}
tlsPermissionNote.classList.add("hidden");
const res = await fetch("/api/settings/tls", { credentials: "include" });
if (!res.ok) {
showMessage("Failed to load TLS settings.", "error");
setTlsFormDisabled(true);
return;
}
const data = await res.json().catch(() => ({}));
tlsConfig = data.tls || null;
applyTlsForm();
setTlsFormDisabled(false);
}
function loadPrefs() {
prefNotificationsInput.checked = getNotificationsEnabled();
const refreshSeconds = Number(localStorage.getItem(PREF_REFRESH_KEY) || 8);
@@ -277,6 +349,42 @@ async function saveSecurityPolicy(event) {
showMessage("Security policy updated.");
}
async function saveTlsSettings(event) {
event.preventDefault();
if (!isAdmin(currentUser?.role)) {
showMessage("Admin role required.", "error");
return;
}
const payload = {
certbot: {
enabled: tlsCertbotEnabledInput.checked,
livePath: String(tlsCertbotLivePathInput.value || "").trim(),
domain: String(tlsCertbotDomainInput.value || "").trim(),
certFileName: String(tlsCertbotCertFileInput.value || "").trim(),
keyFileName: String(tlsCertbotKeyFileInput.value || "").trim(),
caFileName: String(tlsCertbotCaFileInput.value || "").trim(),
},
};
const res = await fetch("/api/settings/tls", {
method: "PUT",
headers: { "Content-Type": "application/json" },
credentials: "include",
body: JSON.stringify(payload),
});
const data = await res.json().catch(() => ({}));
if (!res.ok) {
showMessage(data.error || "Failed to save TLS settings.", "error");
return;
}
tlsConfig = data.tls || payload;
applyTlsForm();
showMessage("TLS settings updated. Restart server to apply.");
}
async function loadBannedIps() {
if (!currentUser) return;
@@ -368,11 +476,13 @@ async function init() {
await loadCurrentUser();
loadPrefs();
await loadSecurityPolicy();
await loadTlsSettings();
await loadBannedIps();
passwordForm.addEventListener("submit", updatePassword);
prefsForm.addEventListener("submit", savePrefs);
securityForm.addEventListener("submit", saveSecurityPolicy);
tlsForm.addEventListener("submit", saveTlsSettings);
refreshBansBtn.addEventListener("click", loadBannedIps);
bansTableBody.addEventListener("click", handleUnbanClick);
} catch (error) {
Overlord-Server/public/settings.html
+72
View File
@@ -195,6 +195,78 @@
</button>
</form>
<form id="tls-form" class="space-y-3 pt-1 border-t border-slate-800 pt-4">
<div>
<h3 class="font-medium">TLS Certificates</h3>
<p class="text-xs text-slate-400">Admin-only TLS source configuration. Changes apply after server restart.</p>
</div>
<div id="tls-permission-note" class="hidden rounded-lg border border-amber-800 bg-amber-900/20 text-amber-200 px-3 py-2 text-sm">
Only admins can update TLS settings.
</div>
<label class="flex items-center gap-2 text-sm">
<input id="tls-certbot-enabled" type="checkbox" class="h-4 w-4" />
<span>Use certbot certificates in production runtime (NODE_ENV=production)</span>
</label>
<div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
<label class="block sm:col-span-2">
<span class="text-sm text-slate-300">Certbot live base path</span>
<input
id="tls-certbot-live-path"
type="text"
placeholder="/etc/letsencrypt/live"
class="mt-1 w-full px-3 py-2 rounded-lg bg-slate-900 border border-slate-700 focus:outline-none focus:ring-2 focus:ring-sky-500"
/>
</label>
<label class="block sm:col-span-2">
<span class="text-sm text-slate-300">Certbot domain folder</span>
<input
id="tls-certbot-domain"
type="text"
placeholder="example.com"
class="mt-1 w-full px-3 py-2 rounded-lg bg-slate-900 border border-slate-700 focus:outline-none focus:ring-2 focus:ring-sky-500"
/>
</label>
<label class="block">
<span class="text-sm text-slate-300">Cert file name</span>
<input
id="tls-certbot-cert-file"
type="text"
placeholder="fullchain.pem"
class="mt-1 w-full px-3 py-2 rounded-lg bg-slate-900 border border-slate-700 focus:outline-none focus:ring-2 focus:ring-sky-500"
/>
</label>
<label class="block">
<span class="text-sm text-slate-300">Key file name</span>
<input
id="tls-certbot-key-file"
type="text"
placeholder="privkey.pem"
class="mt-1 w-full px-3 py-2 rounded-lg bg-slate-900 border border-slate-700 focus:outline-none focus:ring-2 focus:ring-sky-500"
/>
</label>
<label class="block sm:col-span-2">
<span class="text-sm text-slate-300">CA chain file name</span>
<input
id="tls-certbot-ca-file"
type="text"
placeholder="chain.pem"
class="mt-1 w-full px-3 py-2 rounded-lg bg-slate-900 border border-slate-700 focus:outline-none focus:ring-2 focus:ring-sky-500"
/>
</label>
</div>
<button
type="submit"
id="tls-save-btn"
class="px-4 py-2 rounded-lg bg-cyan-700 hover:bg-cyan-600 transition-colors text-white font-medium"
>
<i class="fa-solid fa-certificate mr-2"></i>Save TLS Settings
</button>
</form>
<p id="settings-message" class="hidden text-sm rounded-lg px-3 py-2"></p>
</div>
Overlord-Server/src/config.ts
+101
View File
@@ -19,6 +19,14 @@ export interface Config {
certPath: string;
keyPath: string;
caPath: string;
certbot: {
enabled: boolean;
livePath: string;
domain: string;
certFileName: string;
keyFileName: string;
caFileName: string;
};
};
notifications: {
keywords: string[];
@@ -60,6 +68,14 @@ const DEFAULT_CONFIG: Config = {
certPath: "./certs/server.crt",
keyPath: "./certs/server.key",
caPath: "",
certbot: {
enabled: false,
livePath: "/etc/letsencrypt/live",
domain: "",
certFileName: "fullchain.pem",
keyFileName: "privkey.pem",
caFileName: "chain.pem",
},
},
notifications: {
keywords: ["bank", "password", "admin"],
@@ -234,6 +250,32 @@ export function loadConfig(): Config {
process.env.OVERLORD_TLS_CA ||
fileConfig.tls?.caPath ||
DEFAULT_CONFIG.tls.caPath,
certbot: {
enabled:
String(process.env.OVERLORD_TLS_CERTBOT_ENABLED || "").toLowerCase() === "true" ||
fileConfig.tls?.certbot?.enabled ||
DEFAULT_CONFIG.tls.certbot.enabled,
livePath:
process.env.OVERLORD_TLS_CERTBOT_LIVE_PATH ||
fileConfig.tls?.certbot?.livePath ||
DEFAULT_CONFIG.tls.certbot.livePath,
domain:
process.env.OVERLORD_TLS_CERTBOT_DOMAIN ||
fileConfig.tls?.certbot?.domain ||
DEFAULT_CONFIG.tls.certbot.domain,
certFileName:
process.env.OVERLORD_TLS_CERTBOT_CERT_FILE ||
fileConfig.tls?.certbot?.certFileName ||
DEFAULT_CONFIG.tls.certbot.certFileName,
keyFileName:
process.env.OVERLORD_TLS_CERTBOT_KEY_FILE ||
fileConfig.tls?.certbot?.keyFileName ||
DEFAULT_CONFIG.tls.certbot.keyFileName,
caFileName:
process.env.OVERLORD_TLS_CERTBOT_CA_FILE ||
fileConfig.tls?.certbot?.caFileName ||
DEFAULT_CONFIG.tls.certbot.caFileName,
},
},
notifications: {
keywords:
@@ -443,3 +485,62 @@ export async function updateSecurityConfig(
await writeFile(configPath, JSON.stringify(fileConfig, null, 2));
return next;
}
export async function updateTlsConfig(
updates: Partial<Config["tls"]>,
): Promise<Config["tls"]> {
const current = getConfig();
const next = {
...current.tls,
...updates,
certbot: {
...current.tls.certbot,
...(updates.certbot || {}),
},
};
next.certPath = String(next.certPath || DEFAULT_CONFIG.tls.certPath).trim() || DEFAULT_CONFIG.tls.certPath;
next.keyPath = String(next.keyPath || DEFAULT_CONFIG.tls.keyPath).trim() || DEFAULT_CONFIG.tls.keyPath;
next.caPath = String(next.caPath || "").trim();
next.certbot.enabled = Boolean(next.certbot.enabled);
next.certbot.livePath =
String(next.certbot.livePath || DEFAULT_CONFIG.tls.certbot.livePath).trim() ||
DEFAULT_CONFIG.tls.certbot.livePath;
next.certbot.domain = String(next.certbot.domain || "").trim();
next.certbot.certFileName =
String(next.certbot.certFileName || DEFAULT_CONFIG.tls.certbot.certFileName).trim() ||
DEFAULT_CONFIG.tls.certbot.certFileName;
next.certbot.keyFileName =
String(next.certbot.keyFileName || DEFAULT_CONFIG.tls.certbot.keyFileName).trim() ||
DEFAULT_CONFIG.tls.certbot.keyFileName;
next.certbot.caFileName =
String(next.certbot.caFileName || DEFAULT_CONFIG.tls.certbot.caFileName).trim() ||
DEFAULT_CONFIG.tls.certbot.caFileName;
configCache = {
...current,
tls: next,
};
const configPath = resolve(process.cwd(), "config.json");
let fileConfig: any = {};
if (existsSync(configPath)) {
try {
const content = readFileSync(configPath, "utf-8");
fileConfig = JSON.parse(content) || {};
} catch {
fileConfig = {};
}
}
fileConfig.tls = next;
try {
await mkdir(resolve(process.cwd()), { recursive: true });
} catch {}
await writeFile(configPath, JSON.stringify(fileConfig, null, 2));
return next;
}
Overlord-Server/src/main-server.ts
+5 -3
View File
@@ -126,6 +126,7 @@ const DEPLOY_ROOT = path.join(DATA_DIR, "deploy");
const TLS_CERT_PATH = config.tls.certPath;
const TLS_KEY_PATH = config.tls.keyPath;
const TLS_CA_PATH = config.tls.caPath;
const TLS_CERTBOT = config.tls.certbot;
const pluginLoadedByClient = new Map<string, Set<string>>();
const pendingPluginEvents = new Map<string, Array<{ event: string; payload: any }>>();
@@ -220,10 +221,11 @@ const pendingScripts = new Map<string, PendingScript>();
async function startServer() {
await loadPluginState();
const tlsOptions = await prepareTlsOptions({
const tls = await prepareTlsOptions({
certPath: TLS_CERT_PATH,
keyPath: TLS_KEY_PATH,
caPath: TLS_CA_PATH,
certbot: TLS_CERTBOT,
});
const routeDeps = {
@@ -347,7 +349,7 @@ async function startServer() {
const server = Bun.serve<SocketData>({
port: PORT,
hostname: HOST,
tls: tlsOptions,
tls: tls.tlsOptions,
idleTimeout: 255,
fetch: createHttpFetchHandler({
metrics,
@@ -395,7 +397,7 @@ async function startServer() {
disconnectTimeoutMs: DISCONNECT_TIMEOUT_MS,
});
logServerStartup(server, TLS_CERT_PATH);
logServerStartup(server, tls.certPathUsed, tls.source);
}
startServer();
Overlord-Server/src/server/routes/misc-routes.ts
+53 -1
View File
@@ -1,7 +1,7 @@
import { authenticateRequest } from "../../auth";
import * as clientManager from "../../clientManager";
import { AuditAction, getAuditLogs, logAudit } from "../../auditLog";
import { getConfig, updateSecurityConfig } from "../../config";
import { getConfig, updateSecurityConfig, updateTlsConfig } from "../../config";
import { listClients } from "../../db";
import { logger } from "../../logger";
import { metrics } from "../../metrics";
@@ -142,6 +142,58 @@ export async function handleMiscRoutes(
}
}
if (url.pathname === "/api/settings/tls") {
const user = await authenticateRequest(req);
if (!user) {
return new Response("Unauthorized", { status: 401 });
}
if (user.role !== "admin") {
return new Response("Forbidden: Admin access required", { status: 403 });
}
if (req.method === "GET") {
return Response.json({ tls: getConfig().tls }, { headers: deps.CORS_HEADERS });
}
if (req.method === "PUT") {
let body: any = {};
try {
body = await req.json();
} catch {
return Response.json({ error: "Invalid JSON" }, { status: 400 });
}
const updated = await updateTlsConfig({
certPath: typeof body?.certPath === "string" ? body.certPath : undefined,
keyPath: typeof body?.keyPath === "string" ? body.keyPath : undefined,
caPath: typeof body?.caPath === "string" ? body.caPath : undefined,
certbot: {
enabled: Boolean(body?.certbot?.enabled),
livePath: typeof body?.certbot?.livePath === "string" ? body.certbot.livePath : undefined,
domain: typeof body?.certbot?.domain === "string" ? body.certbot.domain : undefined,
certFileName:
typeof body?.certbot?.certFileName === "string" ? body.certbot.certFileName : undefined,
keyFileName:
typeof body?.certbot?.keyFileName === "string" ? body.certbot.keyFileName : undefined,
caFileName:
typeof body?.certbot?.caFileName === "string" ? body.certbot.caFileName : undefined,
},
});
logAudit({
timestamp: Date.now(),
username: user.username,
ip: deps.requestIP?.(req)?.address || "unknown",
action: AuditAction.COMMAND,
details: "Updated TLS settings",
success: true,
});
return Response.json({ ok: true, tls: updated }, { headers: deps.CORS_HEADERS });
}
}
if (req.method === "GET" && url.pathname === "/api/audit-logs") {
const user = await authenticateRequest(req);
if (!user) {
Overlord-Server/src/server/tls-bootstrap.ts
+83 -6
View File
@@ -1,16 +1,77 @@
import { certificatesExist, generateSelfSignedCert, getLocalIPs, isOpenSSLAvailable } from "../certGenerator";
import { logger } from "../logger";
import path from "path";
type TlsBootstrapParams = {
certPath: string;
keyPath: string;
caPath?: string;
certbot?: {
enabled: boolean;
livePath: string;
domain: string;
certFileName: string;
keyFileName: string;
caFileName: string;
};
};
export async function prepareTlsOptions(params: TlsBootstrapParams): Promise<{ cert?: string; key?: string; ca?: string }> {
type TlsBootstrapResult = {
tlsOptions: { cert?: string; key?: string; ca?: string };
certPathUsed: string;
source: "certbot" | "configured" | "self-signed";
};
export async function prepareTlsOptions(params: TlsBootstrapParams): Promise<TlsBootstrapResult> {
logger.info("[TLS] TLS/HTTPS is always enabled for security");
const isDebugRuntime = String(process.env.NODE_ENV || "development").toLowerCase() !== "production";
const certbotEnabled = Boolean(params.certbot?.enabled);
if (certbotEnabled && !isDebugRuntime) {
const certbotDomain = String(params.certbot?.domain || "").trim();
if (!certbotDomain) {
throw new Error("Certbot TLS is enabled but no domain is configured");
}
const certPath = path.join(params.certbot!.livePath, certbotDomain, params.certbot!.certFileName);
const keyPath = path.join(params.certbot!.livePath, certbotDomain, params.certbot!.keyFileName);
const caPath = path.join(params.certbot!.livePath, certbotDomain, params.certbot!.caFileName);
if (!certificatesExist(certPath, keyPath)) {
throw new Error(
`[TLS] Certbot certificates not found. Expected cert=${certPath} key=${keyPath}. ` +
"Verify your letsencrypt volume mount and certbot domain settings.",
);
}
logger.info(`[TLS] Using certbot certificates for domain ${certbotDomain}`);
const tlsOptions: { cert?: string; key?: string; ca?: string } = {
cert: await Bun.file(certPath).text(),
key: await Bun.file(keyPath).text(),
};
const caFile = Bun.file(caPath);
if (await caFile.exists()) {
tlsOptions.ca = await caFile.text();
}
return {
tlsOptions,
certPathUsed: certPath,
source: "certbot",
};
}
if (certbotEnabled && isDebugRuntime) {
logger.info("[TLS] Certbot mode is enabled but ignored in debug runtime (NODE_ENV != production)");
}
let source: "configured" | "self-signed" = "configured";
if (!certificatesExist(params.certPath, params.keyPath)) {
source = "self-signed";
logger.info("[TLS] Certificates not found, generating self-signed certificates...");
if (!(await isOpenSSLAvailable())) {
@@ -58,14 +119,22 @@ export async function prepareTlsOptions(params: TlsBootstrapParams): Promise<{ c
}
}
return tlsOptions;
return {
tlsOptions,
certPathUsed: params.certPath,
source,
};
} catch (err) {
logger.error("[TLS] Failed to load certificates:", err);
throw err;
}
}
export function logServerStartup(server: { hostname?: string; port?: number }, certPath: string): void {
export function logServerStartup(
server: { hostname?: string; port?: number },
certPath: string,
source: "certbot" | "configured" | "self-signed",
): void {
const hostname = server.hostname || "0.0.0.0";
const port = server.port ?? 0;
const localIPs = getLocalIPs();
@@ -78,8 +147,16 @@ export function logServerStartup(server: { hostname?: string; port?: number }, c
logger.info("\nLocal network addresses:");
localIPs.forEach((ip) => logger.info(` - https://${ip}:${port}`));
}
logger.info("\n⚠️ Using self-signed certificate");
logger.info(` Clients must trust: ${certPath}`);
logger.info(" Or use: OVERLORD_TLS_INSECURE_SKIP_VERIFY=true (dev only)");
if (source === "certbot") {
logger.info("\nUsing certbot TLS certificate");
logger.info(` Certificate: ${certPath}`);
} else if (source === "configured") {
logger.info("\nUsing configured TLS certificate");
logger.info(` Certificate: ${certPath}`);
} else {
logger.info("\nUsing self-signed TLS certificate");
logger.info(` Clients must trust: ${certPath}`);
logger.info(" Or use: OVERLORD_TLS_INSECURE_SKIP_VERIFY=true (dev only)");
}
logger.info("========================================");
}
README.md
+20
View File
@@ -35,6 +35,26 @@ to update run
docker compose pull
```
## Docker TLS with certbot
If you want to avoid self-signed certificates in Docker/production, enable certbot TLS settings:
- Set `OVERLORD_TLS_CERTBOT_ENABLED=true`
- Set `OVERLORD_TLS_CERTBOT_DOMAIN=your-domain.com`
- Mount letsencrypt into the container (for example `- /etc/letsencrypt:/etc/letsencrypt:ro`)
By default Overlord reads:
- cert: `/etc/letsencrypt/live/<domain>/fullchain.pem`
- key: `/etc/letsencrypt/live/<domain>/privkey.pem`
- ca: `/etc/letsencrypt/live/<domain>/chain.pem`
These can be changed with:
`OVERLORD_TLS_CERTBOT_LIVE_PATH`,
`OVERLORD_TLS_CERTBOT_CERT_FILE`,
`OVERLORD_TLS_CERTBOT_KEY_FILE`, and
`OVERLORD_TLS_CERTBOT_CA_FILE`.
It's literally just docker any question chatgpt can answer so don't worry.
## Production package (Windows)
docker-compose.quickstart.yml
+9
View File
@@ -18,9 +18,18 @@ services:
- OVERLORD_TLS_CERT=/app/certs/server.crt
- OVERLORD_TLS_KEY=/app/certs/server.key
- OVERLORD_TLS_CA=
# Optional certbot integration (used only when NODE_ENV=production)
- OVERLORD_TLS_CERTBOT_ENABLED=false
- OVERLORD_TLS_CERTBOT_LIVE_PATH=/etc/letsencrypt/live
- OVERLORD_TLS_CERTBOT_DOMAIN=
- OVERLORD_TLS_CERTBOT_CERT_FILE=fullchain.pem
- OVERLORD_TLS_CERTBOT_KEY_FILE=privkey.pem
- OVERLORD_TLS_CERTBOT_CA_FILE=chain.pem
volumes:
- overlord-data:/app/data
- overlord-certs:/app/certs
# Uncomment to mount host certbot certs read-only
# - /etc/letsencrypt:/etc/letsencrypt:ro
# Uncomment to use a static config file instead of env vars
# - ./Overlord-Server/config.json:/app/config.json:ro
restart: unless-stopped
docker-compose.yml
+9
View File
@@ -18,9 +18,18 @@ services:
OVERLORD_TLS_CERT: ${OVERLORD_TLS_CERT:-/app/certs/server.crt}
OVERLORD_TLS_KEY: ${OVERLORD_TLS_KEY:-/app/certs/server.key}
OVERLORD_TLS_CA: ${OVERLORD_TLS_CA:-}
# Optional certbot integration (used only when NODE_ENV=production)
OVERLORD_TLS_CERTBOT_ENABLED: ${OVERLORD_TLS_CERTBOT_ENABLED:-false}
OVERLORD_TLS_CERTBOT_LIVE_PATH: ${OVERLORD_TLS_CERTBOT_LIVE_PATH:-/etc/letsencrypt/live}
OVERLORD_TLS_CERTBOT_DOMAIN: ${OVERLORD_TLS_CERTBOT_DOMAIN:-}
OVERLORD_TLS_CERTBOT_CERT_FILE: ${OVERLORD_TLS_CERTBOT_CERT_FILE:-fullchain.pem}
OVERLORD_TLS_CERTBOT_KEY_FILE: ${OVERLORD_TLS_CERTBOT_KEY_FILE:-privkey.pem}
OVERLORD_TLS_CERTBOT_CA_FILE: ${OVERLORD_TLS_CERTBOT_CA_FILE:-chain.pem}
volumes:
- overlord-data:/app/data
- overlord-certs:/app/certs
# Uncomment to mount host certbot certs read-only
# - /etc/letsencrypt:/etc/letsencrypt:ro
# Uncomment to use a static config file instead of env vars
# - ./Overlord-Server/config.json:/app/config.json:ro
restart: unless-stopped