PhilandClaude Opus 5.5
ef3a850996
ByteStash matches users on issuer + sub only, so the existing user row was remapped to the Pocket ID user before this was deployed. The old Authentik credentials stay in the vault for rollback. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
1.1 KiB
Django/Jinja
38 lines
1.1 KiB
Django/Jinja
services:
|
|
bytestash:
|
|
image: ghcr.io/jordan-dalby/bytestash:latest
|
|
container_name: bytestash
|
|
restart: unless-stopped
|
|
volumes:
|
|
- bytestash_data:/data/snippets
|
|
environment:
|
|
JWT_SECRET: "{{ vault_bytestash.jwt_secret }}"
|
|
TOKEN_EXPIRY: "24h"
|
|
ALLOW_NEW_ACCOUNTS: "false"
|
|
DEBUG: "false"
|
|
DISABLE_ACCOUNTS: "false"
|
|
DISABLE_INTERNAL_ACCOUNTS: "false"
|
|
OIDC_ENABLED: "true"
|
|
OIDC_DISPLAY_NAME: "Login with Pocket ID"
|
|
OIDC_ISSUER_URL: "https://{{ subdomains.pocketid }}"
|
|
OIDC_CLIENT_ID: "{{ vault_bytestash.pocketid_client_id }}"
|
|
OIDC_CLIENT_SECRET: "{{ vault_bytestash.pocketid_client_secret }}"
|
|
OIDC_SCOPES: "openid profile email"
|
|
extra_hosts:
|
|
- "{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}"
|
|
labels:
|
|
glance.name: ByteStash
|
|
glance.icon: si:code
|
|
glance.url: https://{{ subdomains.bytestash }}/
|
|
glance.description: Code snippet manager
|
|
glance.id: bytestash
|
|
mag37.dockcheck.update: true
|
|
volumes:
|
|
bytestash_data:
|
|
driver: local
|
|
|
|
networks:
|
|
default:
|
|
external: true
|
|
name: {{ docker.network_name }}
|