mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-28 06:05:24 +00:00
ZacharyZcR
872e5eba73
The backend only sees the bundled nginx on loopback, so the allowlist could only work by trusting 127.0.0.1, which let any client that reached nginx log in as anyone by sending the identity headers. nginx now passes its own TCP peer (before real_ip rewriting) in X-Termix-Proxy-Peer, and loopback connections are judged by that address instead.
60 lines
2.1 KiB
YAML
60 lines
2.1 KiB
YAML
services:
|
|
termix:
|
|
image: ghcr.io/termix-ssh/termix:latest
|
|
container_name: termix
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- termix-data:/app/data
|
|
environment:
|
|
PORT: "8080"
|
|
GUACD_HOST: "guacd"
|
|
GUACD_TUNNEL_HOST: "termix"
|
|
GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
|
|
# Where guacd stores files for RDP drive redirection (one folder per
|
|
# user is created underneath). Must be writable by guacd's user.
|
|
GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
|
|
# Multi-instance deployments should point every backend at the same
|
|
# Redis. Without it, collaboration rooms keep their single-instance
|
|
# in-memory fallback.
|
|
# REDIS_URL: "redis://redis:6379"
|
|
# TERMIX_REDIS_PREFIX: "termix:collab"
|
|
# TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
|
|
# Hardened deployments can require keys from environment variables or
|
|
# Docker secrets mounted through JWT_SECRET_FILE, DATABASE_KEY_FILE,
|
|
# ENCRYPTION_KEY_FILE and INTERNAL_AUTH_TOKEN_FILE.
|
|
# TERMIX_REQUIRE_EXTERNAL_SECRETS: "true"
|
|
# Trusted reverse-proxy authentication is disabled by default. When
|
|
# enabled, do not expose this container directly to untrusted clients.
|
|
# TRUSTED_PROXY_AUTH_ENABLED: "true"
|
|
# List the address your authenticating proxy connects from, as this
|
|
# container sees it (for a proxy container on termix-net, its IP there).
|
|
# Keep it narrow: published ports can reach the container from the
|
|
# Docker gateway, so do not trust whole private ranges.
|
|
# TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.20.0.10"
|
|
# TRUSTED_PROXY_AUTH_ROLE_MAP: '{"operators":["user"]}'
|
|
# TRUSTED_PROXY_AUTH_USERNAME_HEADER: "x-forwarded-username"
|
|
# TRUSTED_PROXY_AUTH_ROLE_HEADER: "x-forwarded-role"
|
|
depends_on:
|
|
- guacd
|
|
networks:
|
|
- termix-net
|
|
|
|
guacd:
|
|
image: guacamole/guacd:1.6.0
|
|
container_name: guacd
|
|
restart: unless-stopped
|
|
volumes:
|
|
- termix-data:/termix-data
|
|
networks:
|
|
- termix-net
|
|
|
|
volumes:
|
|
termix-data:
|
|
driver: local
|
|
|
|
networks:
|
|
termix-net:
|
|
driver: bridge
|