s1d3sw1ped/helix-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docker: Promote compose port align to master
Format / gofmt (push) Successful in 14s
Details
CI / Build (push) Successful in 25s
Details
CI / Go Tests (push) Successful in 58s
Details

Browse Source 
Land develop compose/README port align (PR #11 / a6e0693) onto master.

Resolves README divergence vs master ADMIN_PASSWORD docs; keeps ADMIN_PORT=81 healthcheck align. Temporary head branch only — develop retained.

Co-authored-by: s1d3sw1ped_bot <s1d3sw1ped+giteabot@gmail.com>
Co-committed-by: s1d3sw1ped_bot <s1d3sw1ped+giteabot@gmail.com>
This commit was merged in pull request #13.
This commit is contained in:
s1d3sw1ped_bot
2026-09-02 11:39:36 -05:00
committed by s1d3sw1ped_bot
parent ac98b8e942
commit ac295ec330
2 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -3
View File
@@ -26,13 +26,17 @@ Data (db, certs, logs, www html) lives in `./data` relative to where you ran the
## Docker (recommended) ## Docker (recommended)
```bash ```bash
docker compose up -d docker compose up -d
# compose sets ADMIN_PORT=81 PROXY_HTTP_PORT=80 PROXY_HTTPS_PORT=443
# proxy :80/:443 published; admin binds 127.0.0.1:81 (not published by default)
# or # or
docker build -t helix-proxy:dev . docker build -t helix-proxy:dev .
docker run --env ADMIN_PASSWORD='choose-a-real-password' \ docker run --env ADMIN_PASSWORD='choose-a-real-password' \
-e ADMIN_PORT=81 -e ADMIN_HOST=0.0.0.0 -e PROXY_HTTP_PORT=80 -e PROXY_HTTPS_PORT=443 \ -p 80:80 -p 443:443 \
-p 80:80 -p 81:81 -p 443:443 -v $PWD/data:/app/data --workdir /app helix-proxy:dev -e ADMIN_PORT=81 -e PROXY_HTTP_PORT=80 -e PROXY_HTTPS_PORT=443 \
-v $PWD/data:/app/data --workdir /app helix-proxy:dev
``` ```
Publishing admin (`-p 81:81`) also needs `-e ADMIN_HOST=0.0.0.0`. Do not publish :81 on untrusted networks.
Without those env overrides the binary still defaults to admin `127.0.0.1:8081` and proxy `:8080` / `:18443` inside the container. Without those env overrides the binary still defaults to admin `127.0.0.1:8081` and proxy `:8080` / `:18443` inside the container.
PUID/PGID + DISABLE_IPV6 example (see docker-compose.yml for full): PUID/PGID + DISABLE_IPV6 example (see docker-compose.yml for full):
@@ -47,7 +51,7 @@ environment:
Binary auto-chowns data tree (if started root) then drops privs (unless PUID_NO_DROP); umask support via UMASK env. Files 0600, dirs 0755. Binary auto-chowns data tree (if started root) then drops privs (unless PUID_NO_DROP); umask support via UMASK env. Files 0600, dirs 0755.
Note: privilege drop happens early (before listeners); low-port binds require either root (with PUID_NO_DROP), capabilities, high ports in config, or external setuid wrapper. Note: privilege drop happens early (before listeners); low-port binds require either root (with PUID_NO_DROP), capabilities, high ports in config, or external setuid wrapper.
See docker-compose.yml for a full example (publishes 80/443; admin stays on loopback unless you set `ADMIN_HOST` / publish the admin port). See docker-compose.yml for a full example (ADMIN_PORT=81 / proxy 80/443 via env; publishes 80/443; admin stays on loopback unless you set `ADMIN_HOST` / publish the admin port).
## Paths (all overridable) ## Paths (all overridable)
- `data/db.bolt` (or `DATA_DIR`) - `data/db.bolt` (or `DATA_DIR`)
docker-compose.yml
+5 -1
View File
@@ -12,7 +12,11 @@ services:
- ./data:/app/data - ./data:/app/data
# user: "0:0" # required when using PUID/PGID != built-in to allow binary to chown+drop # user: "0:0" # required when using PUID/PGID != built-in to allow binary to chown+drop
# working_dir: /app # binary uses CWD for relative data/ + data/www/ # working_dir: /app # binary uses CWD for relative data/ + data/www/
# environment: environment:
- ADMIN_PORT=81
- PROXY_HTTP_PORT=80
- PROXY_HTTPS_PORT=443
# ADMIN_HOST defaults to 127.0.0.1 (healthcheck hits 127.0.0.1:81)
# - JWT_SECRET= # optional; otherwise a random secret is stored in data/.jwt_secret # - JWT_SECRET= # optional; otherwise a random secret is stored in data/.jwt_secret
# - DATA_DIR=/app/data # - DATA_DIR=/app/data
# - WWW_DIR=/app/data/www # - WWW_DIR=/app/data/www