rsync-s3/docker-compose.cloudflare.yml at main · dgehriger/rsync-s3 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
services:
  # S3 Gateway - rclone serving rsync.net via SFTP as S3
  # Internal only - accessed via Caddy for HTTPS
  s3-gateway:
    image: rclone/rclone:latest
    container_name: rsync-s3-gateway
    command: ["serve", "s3", "rsyncnet:", "--addr", ":9000", "--auth-key", "${S3_ACCESS_KEY},${S3_SECRET_KEY}"]
    environment:
      - RCLONE_CONFIG_RSYNCNET_TYPE=sftp
      - RCLONE_CONFIG_RSYNCNET_HOST=${RSYNC_HOST}
      - RCLONE_CONFIG_RSYNCNET_USER=${RSYNC_USER}
      - RCLONE_CONFIG_RSYNCNET_KEY_FILE=/secrets/rsync_id_ed25519
      - RCLONE_CONFIG_RSYNCNET_SHELL_TYPE=unix
      - RCLONE_CONFIG_RSYNCNET_MD5SUM_COMMAND=none
      - RCLONE_CONFIG_RSYNCNET_SHA1SUM_COMMAND=none
    volumes:
      - ./secrets/rsync_id_ed25519:/secrets/rsync_id_ed25519:ro
    expose:
      - "9000"
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 64M
    networks:
      - rsync-net

  # Caddy - Automatic HTTPS proxy for S3 gateway (with Cloudflare DNS challenge)
  caddy:
    image: caddy:alpine
    container_name: rsync-s3-caddy
    build:
      context: ./caddy
      dockerfile: Dockerfile
    environment:
      - S3_DOMAIN=${S3_DOMAIN:-s3.example.com}
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
    ports:
      - "8443:8443"   # HTTPS on port 8443
    volumes:
      - ./config/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - s3-gateway
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 32M
    networks:
      - rsync-net

  # Snapshot-Aware Browser - FastAPI application
  # Exposed via Cloudflare Tunnel on port 8080
  browser:
    build:
      context: ./browser
      dockerfile: Dockerfile
    container_name: rsync-s3-browser
    environment:
      - S3_ENDPOINT=http://s3-gateway:9000
      - S3_PUBLIC_ENDPOINT=${S3_PUBLIC_ENDPOINT:-}
      - S3_ACCESS_KEY=${S3_ACCESS_KEY}
      - S3_SECRET_KEY=${S3_SECRET_KEY}
      - RSYNC_HOST=${RSYNC_HOST}
      - RSYNC_USER=${RSYNC_USER}
      - SSH_KEY_PATH=/secrets/rsync_id_ed25519
      - SNAPSHOT_DIR=${SNAPSHOT_DIR:-.zfs/snapshot}
      - S3_ROOT_PREFIX=${S3_ROOT_PREFIX:-.}
      - AUTH_MODE=${AUTH_MODE:-cloudflare}
      - AUTH_USERNAME=${AUTH_USERNAME:-admin}
      - AUTH_PASSWORD=${AUTH_PASSWORD:-changeme}
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
    volumes:
      - ./secrets/rsync_id_ed25519:/secrets/rsync_id_ed25519:ro
    ports:
      - "127.0.0.1:8081:8080"  # Localhost only - cloudflared connects here
    depends_on:
      - s3-gateway
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 128M
    networks:
      - rsync-net

networks:
  rsync-net:
    driver: bridge

volumes:
  caddy_data:
  caddy_config: