PhilandClaude Opus 5.5
a1a79af7d5
v0.1.0 (Feb 2025) has dozens of published security advisories fixed in v3. Tested against a copy of the database first; forms load unchanged. v3 listens on 9157, keeps uploads under packages/server, and uses Redis 8 commands, so KeyDB is replaced by redis:8-alpine. The homepage URL is now https (v3's CORS allowlist is built from it), Caddy is the trusted proxy, public sign-up is off, and integration credentials get their own key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
62 lines
1.7 KiB
Django/Jinja
62 lines
1.7 KiB
Django/Jinja
services:
|
|
heyform:
|
|
# Pinned: v3 changed the port, paths and Redis requirements. Read the
|
|
# release notes before bumping.
|
|
image: heyform/community-edition:v3.0.5
|
|
restart: always
|
|
volumes:
|
|
# Persist uploaded images
|
|
- assets:/app/packages/server/static/upload
|
|
depends_on:
|
|
- mongo
|
|
- redis
|
|
environment:
|
|
- APP_HOMEPAGE_URL=https://{{ subdomains.heyform }}
|
|
# Only Caddy may set X-Forwarded-For
|
|
- TRUST_PROXY={{ docker.hairpin_ip }}
|
|
# No public sign-up; new people join through workspace invitations
|
|
- APP_DISABLE_REGISTRATION=true
|
|
- SESSION_KEY={{ vault_heyform.session_key }}
|
|
- FORM_ENCRYPTION_KEY={{ vault_heyform.encryption_key }}
|
|
- INTEGRATION_ENCRYPTION_KEY={{ vault_heyform.integration_encryption_key }}
|
|
- MONGO_URI=mongodb://mongo:27017/heyform
|
|
- REDIS_HOST=redis
|
|
- REDIS_PORT=6379
|
|
- SMTP_FROM=nerderland@{{ email_domains.updates }}
|
|
- SMTP_HOST={{ smtp.host }}
|
|
- SMTP_PORT=465
|
|
- SMTP_USER={{ smtp.username }}
|
|
- SMTP_PASSWORD={{ vault_smtp.password }}
|
|
- SMTP_SECURE=true
|
|
|
|
mongo:
|
|
# HeyForm's own compose files still use 4.4
|
|
image: percona/percona-server-mongodb:4.4
|
|
restart: always
|
|
volumes:
|
|
# Persist MongoDB data
|
|
- database:/data/db
|
|
|
|
redis:
|
|
# v3 needs Redis 8 commands (HGETDEL), so KeyDB no longer works
|
|
image: redis:8-alpine
|
|
restart: always
|
|
command: redis-server --appendonly yes
|
|
labels:
|
|
mag37.dockcheck.update: true
|
|
volumes:
|
|
- redis:/data
|
|
|
|
volumes:
|
|
assets:
|
|
driver: local
|
|
database:
|
|
driver: local
|
|
redis:
|
|
driver: local
|
|
|
|
networks:
|
|
default:
|
|
external: true
|
|
name: {{ docker.network_name }}
|