rays
cc3b8742bc
A database with no accounts created admin with the hard-coded password ipodderx, published in the README, the docs and the sample compose file, and the log line announcing it printed the password. /api/login is open to anyone who reaches the port, and nothing made anyone change it, so a fresh install was an admin account anyone could sign into. Now the password is IPX_ADMIN_PASSWORD when set, for scripted installs, or 24 random hex characters written to admin-password beside config.toml, created 0600 so it is never readable by others even for a moment. The log says where it is, never what it is, as it does for the web token (#40). Existing databases are untouched: seeding runs only with no accounts at all. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
# A sample: ipx with its database in SQLite, and ipx-web, the page, in front of it. Build both
|
|
# images first (`docker build -t ipx .` and `docker build -f Dockerfile.web -t ipx-web .`), then
|
|
# `docker compose up -d`, and sign in at http://<host>:8099 as admin, with the password the first
|
|
# start writes to the config volume: `docker exec ipx cat /config/admin-password`.
|
|
# docs/configuration.md has the rest, Postgres included.
|
|
services:
|
|
ipx:
|
|
image: ipx
|
|
container_name: ipx
|
|
restart: unless-stopped
|
|
environment:
|
|
# Who owns the files it writes. 99:100 is Unraid's nobody:users.
|
|
PUID: "99"
|
|
PGID: "100"
|
|
TZ: "UTC"
|
|
# For Postgres instead of SQLite:
|
|
# IPX_DATABASE_URL: "postgres://ipx:password@db-host:5432/ipx"
|
|
# No web port of its own: ipx-web is the way in, and passes the API on to it.
|
|
ports:
|
|
- "6881:6881/tcp" # BitTorrent peers
|
|
- "6881:6881/udp" # DHT
|
|
volumes:
|
|
- ./config:/config # config.toml, written on first start
|
|
- ./data:/data # state.db
|
|
- ./downloads:/downloads
|
|
|
|
ipx-web:
|
|
image: ipx-web
|
|
container_name: ipx-web
|
|
restart: unless-stopped
|
|
environment:
|
|
IPX_UPSTREAM: "ipx:8099"
|
|
# Behind Cloudflare Access only: where cloudflared's requests come from, the one address
|
|
# whose Cf-Access-* headers are passed on. docs/sso.md says how to find it.
|
|
# TUNNEL_PEER: "192.168.64.1"
|
|
# Traces to an OpenTelemetry collector, a span for each request, continued into ipx:
|
|
# WEB_TRACING: "on"
|
|
# OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
|
|
# OTEL_EXPORTER_OTLP_PROTOCOL: "http/protobuf"
|
|
# OTEL_SERVICE_NAME: "ipx-web"
|
|
ports:
|
|
- "8099:8080" # the web UI
|
|
depends_on:
|
|
- ipx
|