Skip to content

Docker

Jump to bottom
mcinquin edited this page Oct 12, 2026 · 1 revision

Docker

One Compose file in the repository:

File Usage
docker-compose.yml App + PostgreSQL (local build or production-style run)

The app container binds to 127.0.0.1:${PORT:-3000} only. Place a reverse proxy on the host for public HTTPS. The database has no host port published.

Simple run (no reverse proxy)

For local / LAN over HTTP, prefer the README quick start:

cp .env.example .env
# POSTGRES_DB_PASSWORD, NEXTAUTH_SECRET
# NEXTAUTH_URL=http://127.0.0.1:3000
docker compose up -d --build

Open http://127.0.0.1:3000. On first start, scripts/docker-entrypoint.sh runs prisma migrate deploy, seeds default phrases, and creates the admin account if ADMIN_* is set.

Production (HTTPS + Apache)

Prerequisites

  • Docker + Docker Compose
  • Apache 2.4 with proxy, proxy_http, proxy_wstunnel, rewrite, headers, ssl
  • Domain pointing at the server
  • Certbot (Let's Encrypt)

Configure and start

git clone <repo> /opt/markit && cd /opt/markit
cp .env.example .env
# Generate secrets:
#   openssl rand -base64 32  → POSTGRES_DB_PASSWORD
#   openssl rand -base64 32  → NEXTAUTH_SECRET
# NEXTAUTH_URL=https://markit.example.com
docker compose up -d --build
docker compose ps
docker compose logs -f app

Apache

a2enmod proxy proxy_http proxy_wstunnel rewrite headers ssl
certbot certonly --standalone -d markit.example.com
cp /opt/markit/apache/markit.conf /etc/apache2/sites-available/markit.conf
# Replace markit.example.com with your domain
a2ensite markit.conf
apache2ctl configtest
systemctl reload apache2

apache/markit.conf provides:

Feature Detail
HTTP→HTTPS Permanent redirect (301)
TLS 1.2 / 1.3 only
HSTS max-age=63072000; includeSubDomains; preload
HTTP proxy ProxyPass → 127.0.0.1:3000
WebSocket /api/socketio → ws://127.0.0.1:3000
Headers X-Frame-Options, X-Content-Type-Options, Referrer-Policy, forwarded proto/IP overwritten

GHCR images

On each semantic-release on main, images are published to GitHub Container Registry:

  • ghcr.io/mcinquin/markit:latest
  • ghcr.io/mcinquin/markit:X.Y.Z
  • ghcr.io/mcinquin/markit:X.Y

The default docker-compose.yml builds from the Dockerfile. You can retarget app to a GHCR image tag if you prefer pull-only deploys.

Environment variables

Variable Required Description
POSTGRES_USER production PostgreSQL user (default markit)
POSTGRES_DB production Database name (default markit)
POSTGRES_DB_PASSWORD yes PostgreSQL password
DATABASE_URL optional Full URL; leave empty in Docker (built by entrypoint)
PORT optional HTTP port (default 3000); keep NEXTAUTH_URL in sync
NEXTAUTH_URL yes Public site URL
NEXTAUTH_SECRET yes JWT signing key
ADMIN_EMAIL / ADMIN_PASSWORD bootstrap Initial admin (≥ 12 chars); password change forced

Related

Clone this wiki locally