83 lines
2.6 KiB
YAML
83 lines
2.6 KiB
YAML
services:
|
|
# Official NetBird Docker client pattern. Because this peer runs on the
|
|
# Docker host network, it can act as a routing peer for GUAC_DOCKER_SUBNET.
|
|
netbird:
|
|
image: netbirdio/netbird:${NETBIRD_VERSION:-latest}
|
|
container_name: netbird-${WORKER_NAME}
|
|
hostname: ${WORKER_NAME}
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_ADMIN
|
|
- SYS_RESOURCE
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
environment:
|
|
NB_SETUP_KEY: ${NETBIRD_SETUP_KEY:?NETBIRD_SETUP_KEY is required}
|
|
NB_MANAGEMENT_URL: ${NETBIRD_MANAGEMENT_URL:?NETBIRD_MANAGEMENT_URL is required}
|
|
NB_LOG_LEVEL: ${NETBIRD_LOG_LEVEL:-info}
|
|
volumes:
|
|
- netbird-client:/var/lib/netbird
|
|
|
|
guacd:
|
|
image: guacamole/guacd:${GUACAMOLE_VERSION:-1.6.0}
|
|
container_name: ${WORKER_NAME}-guacd
|
|
restart: unless-stopped
|
|
environment:
|
|
LOG_LEVEL: ${GUACD_LOG_LEVEL:-info}
|
|
networks:
|
|
guac_internal:
|
|
ipv4_address: ${GUACD_IP}
|
|
volumes:
|
|
- drive:/drive
|
|
|
|
guacamole:
|
|
# Must contain the SessionGuard Broker + Access-Auth JS extension.
|
|
image: ${SESSIONGUARD_GUAC_IMAGE:?SESSIONGUARD_GUAC_IMAGE is required}
|
|
container_name: ${WORKER_NAME}-guacamole
|
|
restart: unless-stopped
|
|
depends_on:
|
|
guacd:
|
|
condition: service_started
|
|
environment:
|
|
WEBAPP_CONTEXT: ROOT
|
|
GUACD_HOSTNAME: ${GUACD_IP}
|
|
GUACD_PORT: "4822"
|
|
|
|
# SessionGuard Broker over the routed private SessionGuard Docker subnet.
|
|
SESSIONGUARD_MASTER_URL: http://${SESSIONGUARD_IP}:8080
|
|
SESSIONGUARD_BROKER_API_KEY: ${SESSIONGUARD_BROKER_API_KEY:?SESSIONGUARD_BROKER_API_KEY is required}
|
|
SESSIONGUARD_BROKER_TIMEOUT_MS: "2500"
|
|
|
|
# ALL Guacamole workers use the SAME PostgreSQL database.
|
|
POSTGRESQL_ENABLED: "true"
|
|
POSTGRESQL_HOSTNAME: ${GUAC_DB_IP}
|
|
POSTGRESQL_PORT: "5432"
|
|
POSTGRESQL_DATABASE: ${GUAC_DB_NAME:-guacamole_db}
|
|
POSTGRESQL_USERNAME: ${GUAC_DB_USER:-guacamole_user}
|
|
POSTGRESQL_PASSWORD: ${GUAC_DB_PASSWORD:?GUAC_DB_PASSWORD is required}
|
|
POSTGRESQL_AUTO_CREATE_ACCOUNTS: "true"
|
|
|
|
# PocketID is NOT configured in Guacamole. The public Caddy calls
|
|
# SessionGuard ForwardAuth and injects this trusted identity header.
|
|
HTTP_AUTH_ENABLED: "true"
|
|
HTTP_AUTH_HEADER: X-Guacamole-User
|
|
REMOTE_IP_VALVE_ENABLED: "true"
|
|
networks:
|
|
guac_internal:
|
|
ipv4_address: ${GUAC_APP_IP}
|
|
volumes:
|
|
- drive:/drive
|
|
|
|
networks:
|
|
guac_internal:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: ${GUAC_DOCKER_SUBNET}
|
|
|
|
volumes:
|
|
netbird-client:
|
|
drive:
|