ipx runs in an Arcane project of its own; docker-compose.yml is a sample (#208)

Production moved from the content project, beside audiobookshelf, immich and
Plex, to a project called ipx, where the frontend and directory of the split
(#207) will join it. The move changed ipx's network, and sign-in through the
tunnel trusts that network's gateway: the new compose file pins the subnet to
192.168.64.0/20 so the gateway stays 192.168.64.1 if the network is remade,
and config.toml's trusted_proxies names it instead of 192.168.16.1. Checked
by sending a forged Access token from a Docker bridge: it reached the token
check and was refused, which only a trusted peer does.

The repo's compose file was a copy of production's that nobody else could
run. It is now a sample: ipx alone, SQLite, folders beside the file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,31 +1,26 @@
+# A sample: ipx on its own, keeping everything in SQLite. Build the image first
+# (`docker build -t ipx .`), then `docker compose up -d`, and sign in at http://<host>:8099
+# as admin / ipodderx. docs/configuration.md has the rest, Postgres included.
 services:
   ipx:
-    image: 192.168.1.130:5000/ipx:latest
-    container_name: iPX
+    image: ipx
+    container_name: ipx
     restart: unless-stopped
     environment:
+      # Who owns the files it writes. 99:100 is Unraid's nobody:users.
       PUID: "99"
       PGID: "100"
-      TZ: "America/Toronto"
-      IPX_LOG: "ipx=info"
-      # One JSON object a line, which Loki (through Alloy) and the Grafana dashboard read.
-      IPX_LOG_FORMAT: "json"
-      # Traces to Tempo, in the monitoring project; ipx sends none without it.
-      OTEL_EXPORTER_OTLP_ENDPOINT: "http://192.168.1.130:4318"
-      # What the dashboard filters on, so a daemon run by hand for testing stays out of it.
-      OTEL_RESOURCE_ATTRIBUTES: "deployment.environment.name=production"
-    # IPX_DATABASE_URL=postgres://... to use Postgres; without it, /data/state.db (SQLite).
-    env_file:
-      - ipx.env   # relative: Arcane resolves it inside its own container
+      TZ: "UTC"
+      # For Postgres instead of SQLite:
+      # IPX_DATABASE_URL: "postgres://ipx:password@db-host:5432/ipx"
     ports:
       - "8099:8099"          # web UI
-      - "192.168.1.130:9187:9187"  # /metrics for Prometheus, LAN only (ipx#194)
       - "6881:6881/tcp"      # BitTorrent peers
       - "6881:6881/udp"      # DHT
     volumes:
-      - /mnt/fast/appdata/ipx:/config     # config.toml, and the web token
-      - /mnt/user/ipx/:/data         # state.db
-      - /mnt/user/ipx/downloads:/downloads
+      - ./config:/config         # config.toml, written on first start
+      - ./data:/data             # state.db
+      - ./downloads:/downloads
     healthcheck:
       test: ["CMD", "ipx", "status"]
       interval: 30s