lifttrace/docker-compose.yml at main · TraceApps/lifttrace · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
services:
  lifttrace:
    image: ghcr.io/traceapps/lifttrace:latest
    container_name: lifttrace
    ports:
      - "3002:3003"
    volumes:
      - ${DATA_DB_PATH}:/data/db
      - ${DATA_UPLOADS_PATH}:/data/uploads
    environment:
      - DB_PATH=/data/db/lifttrace.db
      - UPLOADS_PATH=/data/uploads
      # Required if using user management — set a long random secret
      - JWT_SECRET=${JWT_SECRET}
      # Or mount a Swarm/Docker secret and set JWT_SECRET_FILE=/run/secrets/<name>
      # If you're serving over plain HTTP (LAN-only, no reverse proxy with TLS),
      # uncomment the next line. Without it, browsers reject the auth cookie and
      # every request returns 401 after a successful login.
      # - INSECURE_COOKIES=1
      # Optional — at-rest encryption key for OIDC client secrets and wearable
      # OAuth tokens. Defaults to a key derived from JWT_SECRET, which means
      # rotating JWT_SECRET also invalidates every encrypted secret. Set this
      # explicitly if you want to rotate session tokens independently.
      # - TOKEN_ENC_KEY=${TOKEN_ENC_KEY:-}
      # Optional — lockout recovery token (required for login page recovery)
      - RECOVERY_TOKEN=${RECOVERY_TOKEN:-}
      # Optional — mount at a subpath instead of root (for reverse-proxy setups)
      # - BASE_URL=/lifttrace
      # Optional — log level: error | warn | info (default) | debug
      - LOG_LEVEL=${LOG_LEVEL:-info}
      # Optional — SMTP email (for password reset & invites). Can also be set in Settings UI.
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_SECURE=${SMTP_SECURE:-false}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASS=${SMTP_PASS:-}
      - SMTP_FROM=${SMTP_FROM:-}
      # Optional — Trace AI (shared key for all users). When set, AI calls
      # are proxied through the server (key never reaches the browser) and the
      # provider/model/key fields are locked in Settings for all users.
      # Supports every provider the app supports — cloud (claude / openai /
      # gemini) and OpenAI-compatible local endpoints (Ollama, LM Studio,
      # LocalAI, vLLM, etc.). Set AI_PROVIDER=oai-compat + AI_BASE_URL +
      # AI_MODEL to point at a private-network LLM the browser can't reach
      # directly (e.g. an Ollama sidecar on this compose network).
      # - AI_PROVIDER=${AI_PROVIDER:-}            # claude | openai | gemini | oai-compat
      # - AI_API_KEY=${AI_API_KEY:-}              # required for cloud; optional for oai-compat
      # - AI_MODEL=${AI_MODEL:-}                  # optional for cloud; REQUIRED for oai-compat
      # - AI_BASE_URL=${AI_BASE_URL:-}            # REQUIRED for oai-compat, e.g. http://ollama:11434
      # - AI_ENABLED=${AI_ENABLED:-}
      # Optional — OIDC Single Sign-On declared in env instead of the Settings UI.
      # Single-provider shorthand (`OIDC_*` is an alias for `OIDC_PROVIDER_1_*`):
      # - OIDC_ISSUER=${OIDC_ISSUER:-}
      # - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
      # - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
      # - OIDC_DISPLAY_NAME=${OIDC_DISPLAY_NAME:-}
      # - OIDC_REDIRECT_URIS=${OIDC_REDIRECT_URIS:-}        # comma-separated for multi
      # - OIDC_SCOPE=${OIDC_SCOPE:-}
      # - OIDC_ADMIN_GROUP_CLAIM=${OIDC_ADMIN_GROUP_CLAIM:-}
      # - OIDC_ADMIN_GROUP_VALUE=${OIDC_ADMIN_GROUP_VALUE:-}
      # - OIDC_AUTO_LINK=${OIDC_AUTO_LINK:-1}
      # - OIDC_AUTO_REGISTER=${OIDC_AUTO_REGISTER:-0}
      # Multi-provider — repeat with the numbered prefix:
      # - OIDC_PROVIDER_2_ISSUER=${OIDC_PROVIDER_2_ISSUER:-}
      # - OIDC_PROVIDER_2_CLIENT_ID=${OIDC_PROVIDER_2_CLIENT_ID:-}
      # - OIDC_PROVIDER_2_CLIENT_SECRET=${OIDC_PROVIDER_2_CLIENT_SECRET:-}
      # - OIDC_PROVIDER_2_DISPLAY_NAME=${OIDC_PROVIDER_2_DISPLAY_NAME:-}
      # Env-defined providers show with a lock badge in Settings → Admin → OIDC
      # providers and are read-only there — edit via .env / docker-compose / k8s secrets.
      # Any server env var may also be supplied via <NAME>_FILE, for example:
      # - SMTP_PASS_FILE=/run/secrets/lifttrace_smtp_pass
      # - AI_API_KEY_FILE=/run/secrets/lifttrace_ai_api_key
      # - TOKEN_ENC_KEY_FILE=/run/secrets/lifttrace_token_enc_key
      # - RECOVERY_TOKEN_FILE=/run/secrets/lifttrace_recovery_token
    restart: unless-stopped