mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
7da0080557
* docs(wiki): correct the install and operations pages for 4.0.0 Quick Start passed docker an empty ENCRYPTION_KEY: an assignment prefix is not expanded on the same command line, so the server silently generated its own key instead of taking the one the page told you to set. The tag examples pinned to the 3.x line, the documented tmpfs size did not match the shipped compose file, and several .env values were described as reaching the container when compose never interpolates them. * docs(wiki): match the MCP reference to the registered surface The scope table was missing the whole Collections group and the totals said 27 scopes across 13 groups where the code registers 29 across 14. The Cloudflare link on the setup page pointed at an anchor on its own page instead of the heading on Troubleshooting. * docs(wiki): correct the plugin and admin pages Three links to Plugin-Development carried a .md suffix, which does not resolve on the wiki. The admin pages described tabs, permissions and storage behaviour that had moved on. * docs(wiki): bring the feature pages back in line with the app Costs still documented the old panel, where categories could be added, renamed, reordered and deleted; they are fixed now and the panel is a day-grouped ledger with settlements. Trip sharing, journeys, maps, packing, reservations and the account pages had all drifted in the same way. * docs(wiki): cover the pages the first pass did not reach The MCP catalog listed 168 of the 201 registered tools; the settlement tools and rate_place were missing here and the Collections family from the addon page. Several resource rows claimed a trips:* scope where the handler asks for trips:read. * docs(wiki): tighten the corrections a review picked apart The audit-log resource is the row id, not the credential id; an admin password reset does not bump password_version the way the page implied; and a few of the new paragraphs described behaviour more confidently than the code supports. * docs(wiki): fix what a last read-through caught Costs shows every figure in your display currency, not the trip's, and an expense with no payer still counts against the members it is split between. Studio's cutoff is a 1024px viewport rather than phones alone, and the Integrations tab is gated on the providers an admin has configured. * docs(wiki): the last few the review caught A passkey satisfies the MFA policy everywhere except the WebSocket handshake, which still asks for TOTP, so a passkey-only account under that policy gets no live updates. Mobile optimizes a day from two places, not three. The ctx.db row carried an unescaped pipe that split the table, and the Backups table linked with a wiki link whose pipe did the same.
109 lines
4.8 KiB
Markdown
109 lines
4.8 KiB
Markdown
# Install: Docker Compose
|
|
|
|
Production-ready setup using Docker Compose with security hardening enabled.
|
|
|
|
## Compose File
|
|
|
|
See https://github.com/liketrek/TREK/blob/main/docker-compose.yml
|
|
|
|
## Security Hardening Explained
|
|
|
|
The compose file ships with several hardening options enabled by default:
|
|
|
|
| Setting | What it does |
|
|
|---|---|
|
|
| `read_only: true` | Mounts the container filesystem read-only; only the two named volumes and `/tmp` are writable |
|
|
| `security_opt: no-new-privileges:true` | Prevents the process from gaining additional Linux privileges via setuid/setgid executables |
|
|
| `cap_drop: [ALL]` | Drops all Linux capabilities from the container |
|
|
| `cap_add: [CHOWN, SETUID, SETGID]` | Adds back only the capabilities needed for the entrypoint to drop privileges to the `node` user |
|
|
| `tmpfs: /tmp:noexec,nosuid,size=128m` | Mounts a 128 MB in-memory `/tmp`; required because the container root is read-only |
|
|
|
|
> **Note (Docker from snap):** If you installed Docker via `snap` (config under `/var/snap/docker/...`), `no-new-privileges:true` will prevent the container from starting with `exec /usr/bin/dumb-init: operation not permitted`. This is a [snap/AppArmor limitation](https://bugs.launchpad.net/snapd/+bug/1908448), not a TREK issue — install Docker from the [official apt repository](https://docs.docker.com/engine/install/ubuntu/) instead, or remove `no-new-privileges`. See [Troubleshooting](Troubleshooting#container-wont-start-exec-usrbindumb-init-operation-not-permitted).
|
|
|
|
## Volumes
|
|
|
|
| Host path | Container path | Contents |
|
|
|---|---|---|
|
|
| `./data` | `/app/data` | SQLite database, logs, `.jwt_secret`, `.encryption_key` |
|
|
| `./uploads` | `/app/uploads` | Uploaded files (photos, documents, covers, avatars) |
|
|
|
|
### Named Volumes
|
|
|
|
The compose file above uses bind mounts (`./data`, `./uploads`). You can switch to Docker named volumes, which are fully managed by Docker and not tied to a specific host path. See the [Docker Compose volumes reference](https://docs.docker.com/reference/compose-file/volumes/) for all options.
|
|
|
|
```yaml
|
|
services:
|
|
app:
|
|
# ... (rest of service config unchanged)
|
|
volumes:
|
|
- trek_data:/app/data
|
|
- trek_uploads:/app/uploads
|
|
|
|
volumes:
|
|
trek_data:
|
|
trek_uploads:
|
|
```
|
|
|
|
Docker creates the volumes automatically on first `docker compose up`. Use `docker volume ls` and `docker volume inspect` to manage them.
|
|
|
|
## Environment Variables
|
|
|
|
The compose file has no `env_file:` key, so a `.env` placed alongside `docker-compose.yml` is used only for `${VAR}` interpolation — a value reaches the container only if a line in the `environment:` block references it. Four entries are wired that way:
|
|
|
|
```bash
|
|
# .env
|
|
ENCRYPTION_KEY=<output of: openssl rand -hex 32>
|
|
TZ=Europe/Berlin
|
|
LOG_LEVEL=info
|
|
ALLOWED_ORIGINS=https://trek.example.com
|
|
```
|
|
|
|
The commented `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` lines are interpolated as well, so uncommenting them is enough to pick their values up from `.env`.
|
|
|
|
Every other variable — `APP_URL`, the OIDC block, `FORCE_HTTPS`, `TRUST_PROXY`, `ADMIN_EMAIL`/`ADMIN_PASSWORD`, the MCP limits — ships as a commented literal. Uncomment the line in `docker-compose.yml` and put the value there; setting it in `.env` alone has no effect.
|
|
|
|
`APP_URL` is usually not needed. TREK resolves its public base URL as `APP_URL` → first `ALLOWED_ORIGINS` entry → `http://localhost:<PORT>`, so the `ALLOWED_ORIGINS` value above already gives OIDC redirect URIs, passkey origin checks and the links in email notifications the correct origin. Uncomment `APP_URL` only when the public base URL has to differ from the first allowed origin.
|
|
|
|
For a full description of every variable, see [Environment-Variables](Environment-Variables).
|
|
|
|
## Image Tags
|
|
|
|
Three tag strategies are available:
|
|
|
|
| Tag | Example | Behavior |
|
|
|---|--------------------------|---|
|
|
| `latest` | `mauriceboe/trek:latest` | Always the newest release across all major versions |
|
|
| Major version | `mauriceboe/trek:4` | Latest release pinned to that major version |
|
|
| Full version | `mauriceboe/trek:4.0.0` | Exact release; never changes |
|
|
|
|
The compose file above uses `latest`. To pin, change the `image:` line:
|
|
|
|
```yaml
|
|
image: mauriceboe/trek:4 # track major version 4
|
|
image: mauriceboe/trek:4.0.0 # pin to exact release
|
|
```
|
|
|
|
## Start TREK
|
|
|
|
```bash
|
|
docker compose up -d
|
|
```
|
|
|
|
Check the logs:
|
|
|
|
```bash
|
|
docker compose logs -f
|
|
```
|
|
|
|
## HTTPS and Reverse Proxy
|
|
|
|
This compose file is designed for deployments where a reverse proxy (nginx, Caddy, Traefik) terminates TLS in front of TREK. To enable HTTPS redirects and secure cookies, uncomment `FORCE_HTTPS=true` and `TRUST_PROXY=1`.
|
|
|
|
See [Reverse-Proxy](Reverse-Proxy) for complete proxy configuration examples.
|
|
|
|
## Next Steps
|
|
|
|
- [Environment-Variables](Environment-Variables) — full variable reference
|
|
- [Reverse-Proxy](Reverse-Proxy) — HTTPS configuration
|
|
- [Updating](Updating) — how to pull a new image
|