# docker-elabftw configuration file # use : "docker-compose up -d" to start containers # this config file contains all the possible configuration options, shown with default values # https://hub.docker.com/r/elabftw/elabimg/ # https://www.elabftw.net # this is the "compose project name" # see: https://docs.docker.com/compose/compose-file/04-version-and-name/ name: elabftw # the internal elabftw network on which both containers will run networks: elabftw-net: # the services are the elabftw container (webservice) and MySQL (database) services: # our first container is nginx + php-fpm + elabftw web: # About tags (the part after the :) # stable points to the latest stable version # latest points to the latest version, including alpha/beta # use a specific version tag to pin the image # example: elabftw/elabimg:4.0.5 # default value: elabftw/elabimg:stable image: elabftw/elabimg:stable # this ensures the container will be restarted after a reboot of the server # default value: always restart: always # comment this out if you use several containers with redis, as you can't have several containers with the same name # default value: elabftw container_name: elabftw # make sure we wait for mysql to be available before starting # comment this out if you're not using a mysql container # note: the mysql container needs an healthcheck block for this to work depends_on: mysql: condition: service_healthy # limit number of processes # this option is commented out because it is not in v3 of compose files, only v2 # even though it works as expected in a v3 file with recent docker-compose #pids_limit: 42 # add a security flag to prevent a process gaining new privileges security_opt: - no-new-privileges:true # restrict capabilities of the root user to the strict minimum # see CIS Docker Benchmark v1.5 5.3 # see ANSSI-FT-082 23/09/2020 R8 # WARNING: for Centos7/8, comment out these lines (cap_drop and cap_add) # If you get this error in the logs: # nginx: [emerg] bind() to 0.0.0.0:443 failed (13: Permission denied) # comment out these lines! cap_drop: - ALL cap_add: - CHOWN - SETGID - SETUID - FOWNER - DAC_OVERRIDE # environment variables passed to the container to configure options at run time (when container is started) # commented variables are optional environment: ####################### # MYSQL CONFIGURATION # ####################### # name of the MySQL server (by default "mysql" the name of the mysql container in default elabftw Docker configuration) # you can put here the IP address of an existing MySQL server if you already have one running # default value: mysql - DB_HOST=mysql # port on which the MySQL server is listening # you probably don't need to modify this value # default value: 3306 - DB_PORT=3306 # name of the MySQL database # you probably don't need to modify this value # default value: elabftw - DB_NAME=elabftw # MySQL user with write access to the previously named database # you probably don't need to modify this value # default value: elabftw - DB_USER=elabftw # MySQL password; a random password has been generated for you but feel free to change it if needed # default value: generated randomly if you get the config from get.elabftw.net - DB_PASSWORD=secr3t # Mysql Cert path: you only need this if you connect to a mysql server with tls # Use a volume that points to /mysql-cert in the container # optional #- DB_CERT_PATH=/mysql-cert/cert.pem ##################### # PHP CONFIGURATION # ##################### # the timezone in which the server is # better if changed (see list of available values: http://php.net/manual/en/timezones.php - PHP_TIMEZONE=Europe/Paris # again - TZ=Europe/Paris # optional: set the limit of simultaneous request that will be served # see http://php.net/manual/en/install.fpm.configuration.php # default value: 50 #- PHP_MAX_CHILDREN=50 # optional: adjust the max execution time of PHP scripts, in seconds # default value: 120 #- PHP_MAX_EXECUTION_TIME=120 # optional: adjust the amount of memory available to PHP, increase it if you run into issues # information: 2G of memory available to PHP might seem a lot. But realize this: it's not 2003 anymore. PHP is not just a few "if" and "foreach" in some html page. # We use it to generate huge PDF files and archives, to manipulate potentially big images, and do complicated operations on thousands of objects fast. # So yeah, the conservative 128 Mb default is obsolete when a simple photo taken with a phone can be 10 Mb. # Most of the servers that run eLabFTW will run ONLY eLab and will easily have at least 4 Gb of RAM dedicated to this task. # What is the point of having 4 Gb of RAM and let the main application use only a few percents of it... # This doesn't mean that eLabFTW will consume that much memory all the time. 99% of the time it will have very low memory footprint. # But from time to time, users will export many entries at once in PDF with big images in them and that's when you want to have some headroom! # example value: 4G # default value: 2G #- MAX_PHP_MEMORY=2G # optional: set a password to get access to /php-status, which will display various metrics about the php-fpm processes # also works for /nginx-status, for metrics about nginx process # if this is not set, a random password will be generated but never displayed, effectively disabling access to this endpoint # the enpdoint can be accessed with the "elabftw" user, and the password you set below # example value: my-cool-password # default value: not set #- STATUS_PASSWORD= ######################### # ELABFTW CONFIGURATION # ######################### # The secret key is used for encrypting the SMTP and Timestamping passwords # A random one has been generated for you, if you wish to change it you can # get another secret key from https://get.elabftw.net/?key # if you don't want to get it from an external source you can also do that: # docker run --rm -t --entrypoint '/bin/sh' elabftw/elabimg -c "php -d memory_limit=10M -d open_basedir='' bin/init tools:genkey" # Note: the value MUST be generated as shown in the methods above. # default value: generated randomly if you get the config from get.elabftw.net - SECRET_KEY= # The canonical URL to the website, including port if not standard # Use the user-facing URL here. # example value: https://elab.uni-delta.fr # example value: https://elab.uni-delta.fr:3148 - SITE_URL= # optional: adjust maximum size of uploaded files # default value: 100M #- MAX_UPLOAD_SIZE=100M # optional: adjust maximum time for uploading files, in milliseconds # default value: 900000 #- MAX_UPLOAD_TIME=900000 # optional: s3 storage credentials #- ELAB_AWS_ACCESS_KEY= #- ELAB_AWS_SECRET_KEY= ####################### # NGINX CONFIGURATION # ####################### # change to your server name in nginx config # default value: localhost # example value: elab.uni.edu - SERVER_NAME=localhost # optional: disable https, use this to have an http server listening on port 443 # useful if the SSL stack is handled by haproxy or something alike # default value: false - DISABLE_HTTPS=false # set to true to use letsencrypt or other certificates # note: does nothing if DISABLE_HTTPS is set to true # default value: false - ENABLE_LETSENCRYPT=false # optional: enable ipv6 (make sure you have an AAAA dns record!) # default value: false #- ENABLE_IPV6=false # optional: adjust the user/group that will own the uploaded files (and run the webserver) # useful if your files are stored on an NFS mount point where the files ownership are imposed by the NFS server # default value: nginx # example value: nobody #- ELABFTW_USER=nginx # default value: nginx # example value: nobody #- ELABFTW_GROUP=nginx # default value: 101 # example value: 65534 #- ELABFTW_USERID=101 # default value: 101 # example value: 65534 #- ELABFTW_GROUPID=101 # optional: enable if you want nginx to be configured with set_real_ip_from directives # default value: false #- SET_REAL_IP=false # the IP address/addresses. Separate them with a , AND A SPACE. Several set_real_ip_from lines will be added to the nginx config. One for each. # this does nothing if SET_REAL_IP is set to false #- SET_REAL_IP_FROM=192.168.31.48, 192.168.0.42, 10.10.13.37 # optional: adjust the number of worker processes nginx will spawn # default value: auto # if auto doesn't work for you, use the number of cores available on the server (or less) #- NGINX_WORK_PROC=auto # optional: allow javascript code to call the API from an external service # this will add a response header Access-Control-Allow-Origin with content of the env var as value # mdn doc: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin # default: header not set (empty value) # example value: app.example.org # example value: * #- ALLOW_ORIGIN= # optional: define methods allowed to javascript code calling the API from an external service # this will add a response header Access-Control-Allow-Methods with content of the env var as value # mdn doc: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods # default: header not set (empty value) # example value: GET, POST, PATCH #- ALLOW_METHODS= # optional: define headers allowed to javascript code calling the API from an external service # this will add a response header Access-Control-Allow-Headers with content of the env var as value # mdn doc: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers # default: header not set (empty value) # example value: Content-Type, Authorization #- ALLOW_HEADERS= # optional: modify the keepalive_timeout value # nginx doc: http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout # default: 10s # example value: 5s #- KEEPALIVE_TIMEOUT=10s ####################### # REDIS CONFIGURATION # ####################### # optional: use a redis server to store the PHP sessions # default value: false #- USE_REDIS=false # optional: set an IP or hostname for the redis server # default value: redis #- REDIS_HOST=redis # optional: set a custom port for redis # default value: 6379 #- REDIS_PORT=6379 # optional: set a username for redis # default value: #- REDIS_USERNAME= # optional: set a password for redis # default value: #- REDIS_PASSWORD= ###################### # LDAP CONFIGURATION # ###################### # optional: configure ldap certificate verification behavior: will create /etc/openldap/ldap.conf with TLS_REQCERT config line # default value: false # possible values: never, allow, try #- LDAP_TLS_REQCERT=false ################# # MISCELLANEOUS # ################# # optional: be less verbose during init # default value: false #- SILENT_INIT=false # optional: automatically install the database structure on container start # default value: false #- AUTO_DB_INIT=false # optional: automatically update the database structure on container start # default value: false #- AUTO_DB_UPDATE=false ####### # DEV # ####### # set to true in a development environment. # This will remove php cache, serve assets directly (instead of the brotli/gzip version) and make composer available. # default value: false #- DEV_MODE=false ports: # Important note about exposing ports: due to the way Docker deals with the host firewall, it is recommended to use '127.0.0.1:1234:443' # if you only want to expose the service locally (on port 1234 in this example). See https://github.com/moby/moby/issues/22054 # Another option is to use the "expose" directive instead of "ports" and let your reverse proxy figure things out. # # if you want elabftw to run on a different port, change the first number # host:container - '443:443' # if you are aiming for running multiple instances of this container you can put a range like so: # - "3100-3200:443" # use redis for session storage if that is the case, or configure your load balancer with sticky sessions volumes: # this is where you will keep the uploaded files persistently # for Windows users it might look like this # - D:\Users\Nico\elab-data\web:/elabftw/uploads # host:container - /var/elabftw/web:/elabftw/uploads # # TLS configuration # # Note: if your certificate is not from letsencrypt, make sure to have those two files: # # /etc/letsencrypt/live/SERVER_NAME/fullchain.pem # /etc/letsencrypt/live/SERVER_NAME/privkey.pem # # in the folder /etc/letsencrypt (or any folder you like as long as you adapt the line below # replace SERVER_NAME with the value of SERVER_NAME of course. # # if you have enabled letsencrypt, uncomment the line below # path to the folder with TLS certificate + private key # host:container #- /etc/letsencrypt:/ssl # # MYSQL cert path #- /path/to/cert/folder:/mysql-cert # This part is just an example for having a custom DNS entry in /etc/hosts of the container # Use it if DNS resolution cannot work for some reason # The "extra_hosts" key must be aligned at the same indentation level as "ports" or "volumes" or "networks" blocks. # # extra_hosts: # - internal.s3.example.org:10.12.34.56 networks: - elabftw-net # the mysql database image # Note: if you already have a MySQL server running, you don't need to use this image, as you can use the already existing one # In this case, add the IP address of the server in DB_HOST and comment out or remove this block mysql: image: mysql:8.0 restart: always container_name: mysql # add an healthcheck block so the web container knows when it is ready to accept connections # use double $ here so env vars are correctly found healthcheck: test: "/usr/bin/mysql --user=$$MYSQL_USER --password=$$MYSQL_PASSWORD --execute 'SHOW DATABASES;'" interval: 5s timeout: 5s retries: 42 # drop some capabilities cap_drop: - AUDIT_WRITE - MKNOD - SYS_CHROOT - SETFCAP - NET_RAW cap_add: - SYS_NICE environment: # need to change - MYSQL_ROOT_PASSWORD=secr3t # no need to change - MYSQL_DATABASE=elabftw # no need to change - MYSQL_USER=elabftw # need to change IMPORTANT: this should be the same password as DB_PASSWORD from the elabftw container - MYSQL_PASSWORD=secr3t # need to change, this is your timezone, see PHP_TIMEZONE from the elabftw container - TZ=Europe/Paris # Update this if you want to run the server on a different port than 3306. # - MYSQL_TCP_PORT=3306 volumes: # this is where you will keep the database persistently # for Windows users it might look like this # - D:\Users\Nico\elab-data\mysql:/var/lib/mysql # host:container - /var/elabftw/mysql:/var/lib/mysql # The mysql container exposes 3306/33060. Though it does not make an operational difference, # make sure to document your usage here. expose: - '3306' networks: - elabftw-net # example of a redis container # uncomment if you want to spawn a redis container to manage sessions #redis: # image: redis:7-alpine # restart: always # container_name: redis # networks: # - elabftw-net # example of a keeex container (experimental!) #keeex: # image: repo.keeex.me/fkeeex_daemon:latest # container_name: keeex # restart: always # environment: # - FKEEEX_CONFIG_USER=user@example.org # - FKEEEX_CONFIG_PASSWORD= # # Set a random passphrase here. You can generate one with "openssl rand -base64 32". # - FKEEEX_CONFIG_PASSPHRASE= # expose: # - 8080 # networks: # - elabftw-net ############################################################### # EVERYTHING BELOW THISĀ LINE IS FORĀ DEVELOPMENT PURPOSES ONLY # # You can safely delete everything below # ############################################################### # PHPMYADMIN # uncomment this part if you want to have phpmyadmin running too #phpmyadmin: # image: phpmyadmin/phpmyadmin # container_name: phpmyadmin # environment: # - PMA_PORT=3307 # links: # - mysql:db # ports: # - "8080:80" # networks: # - elabftw-net # SWAGGER UI # swagger allows you to consult the documentation generated by apidoc/v2/openapi.yaml # running a local container is perfect to see the changes right after a change # #swagger: # image: swaggerapi/swagger-ui:v5.0.0 # restart: always # container_name: swagger-elab-local # ports: # - "8085:8080" # volumes: # - /path/to/local/elabftw/apidoc/v2:/usr/share/nginx/html/swagger:ro # environment: # - API_URL=swagger/openapi.yaml # networks: # - elabftw-net # LDAP # example for ldap server + admin interface # uncomment if you want to work on LDAP authentication #ldap: # image: osixia/openldap:1.4.0 # container_name: ldap # restart: always # hostname: example.org # environment: # - LDAP_TLS_VERIFY_CLIENT=try # - LDAP_OPENLDAP_UID=1000 # - LDAP_OPENLDAP_GID=1000 # ports: # - "389:389" # - "636:636" # volumes: # - /var/elabftw/ldap-data/ldap:/var/lib/ldap # - /var/elabftw/ldap-data/slapd.d:/etc/ldap/slapd.d # networks: # - elabftw-net #ldapadmin: # image: osixia/phpldapadmin:0.9.0 # container_name: ldapadmin # environment: # - PHPLDAPADMIN_LDAP_HOSTS=ldap # restart: always # ports: # - "6443:443" # networks: # - elabftw-net