bjoernpoettkerandClaude Opus 5.5
c28475f71f
Bisher prüfte das Backend nur Issuer und Signatur. Ein Access-Token, das derselbe Authentik-Provider für eine andere Anwendung ausgestellt hat, wurde ebenfalls akzeptiert. - JwtStrategy verlangt aud == OIDC_CLIENT_ID (jwt-optionen.ts, getestet mit echten RS256-Tokens). Ohne OIDC_CLIENT_ID bleibt die Prüfung aus, mit Warnung beim Start. - docker-compose.yml übergibt OIDC_CLIENT_ID jetzt ans Backend, Standard: dieselbe Client-ID wie das Frontend (VITE_OIDC_CLIENT_ID). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
89 lines
3.9 KiB
YAML
89 lines
3.9 KiB
YAML
services:
|
||
# ─── Backend (NestJS) ──────────────────────────────────────
|
||
backend:
|
||
image: gitea.poettker-cloud.de/bjoernpoettker/paperlessmanager-backend:latest
|
||
build: ./paperless-backend
|
||
container_name: paperless-backend
|
||
restart: unless-stopped
|
||
ports:
|
||
- "${BACKEND_PORT:-7601}:3100"
|
||
environment:
|
||
- NODE_ENV=production
|
||
- CORS_ORIGIN=${CORS_ORIGIN:-}
|
||
- PORT=3100
|
||
- DB_HOST=${DB_HOST:-db}
|
||
- DB_PORT=${DB_PORT:-3306}
|
||
- DB_USERNAME=${DB_USERNAME:-root}
|
||
- DB_PASSWORD=${DB_PASSWORD:-changeme}
|
||
- DB_DATABASE=${DB_DATABASE:-paperlessadd}
|
||
- PAPERLESS_URL=${PAPERLESS_URL:-http://paperless:8000}
|
||
- PAPERLESS_TOKEN=${PAPERLESS_TOKEN:-}
|
||
- PAPERLESS_PROCESSOR_CRON=${PAPERLESS_PROCESSOR_CRON:-0 * * * * *}
|
||
- OLLAMA_URL=${OLLAMA_URL:-http://ollama:11434}
|
||
- OLLAMA_MODEL=${OLLAMA_MODEL:-llava}
|
||
- SCANNER_ARCHIVE_DIR=${SCANNER_ARCHIVE_DIR:-/data/scanner/_processed_archive}
|
||
- OIDC_ISSUER=${OIDC_ISSUER:-}
|
||
# Audience-Prüfung der Tokens – muss dieselbe Client-ID wie im Frontend sein
|
||
- OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-${VITE_OIDC_CLIENT_ID:-ogOeIlrcsf2spjuwyOc7CuAPrRkRSt3RXfYguoLn}}
|
||
- SMTP_HOST=${SMTP_HOST:-}
|
||
- SMTP_PORT=${SMTP_PORT:-587}
|
||
- SMTP_SECURE=${SMTP_SECURE:-false}
|
||
- SMTP_USER=${SMTP_USER:-}
|
||
- SMTP_PASS=${SMTP_PASS:-}
|
||
- SMTP_FROM=${SMTP_FROM:-paperless@localhost}
|
||
- SMTP_FROM_NAME=${SMTP_FROM_NAME:-}
|
||
- SMTP_ENCRYPTION_KEY=${SMTP_ENCRYPTION_KEY:-}
|
||
- POSTPROCESSING_ERROR_TAG=${POSTPROCESSING_ERROR_TAG:-0}
|
||
- MANUELL_BEARBEITEN_TAG=${MANUELL_BEARBEITEN_TAG:-6}
|
||
- IMAP_HOST=${IMAP_HOST:-}
|
||
- IMAP_PORT=${IMAP_PORT:-993}
|
||
- IMAP_USE_SSL=${IMAP_USE_SSL:-true}
|
||
- IMAP_USERNAME=${IMAP_USERNAME:-}
|
||
- IMAP_PASSWORD=${IMAP_PASSWORD:-}
|
||
- IMAP_IMPORTED_FOLDER=${IMAP_IMPORTED_FOLDER:-importiert}
|
||
- IMAP_TRASH_FOLDER=${IMAP_TRASH_FOLDER:-Trash}
|
||
- BELEGNUMMER_GET_URL=${BELEGNUMMER_GET_URL:-}
|
||
- BELEGNUMMER_SET_URL=${BELEGNUMMER_SET_URL:-}
|
||
- AGRARMONITOR_BASE_URL=${AGRARMONITOR_BASE_URL:-https://admin7.agrarmonitor.de}
|
||
- AGRARMONITOR_API_BASE_URL=${AGRARMONITOR_API_BASE_URL:-https://api.agrarmonitor.de}
|
||
- AGRARMONITOR_USERNAME=${AGRARMONITOR_USERNAME:-}
|
||
- AGRARMONITOR_PASSWORD=${AGRARMONITOR_PASSWORD:-}
|
||
- AGRARMONITOR_API_TOKEN=${AGRARMONITOR_API_TOKEN:-}
|
||
- AGRARMONITOR_COOKIE_PATH=${AGRARMONITOR_COOKIE_PATH:-./data/agrarmonitor-cookies.json}
|
||
- AGRARMONITOR_ENCRYPTION_KEY=${AGRARMONITOR_ENCRYPTION_KEY:-}
|
||
- AGRARMONITOR_POLLING_CRON=${AGRARMONITOR_POLLING_CRON:-}
|
||
- AGRARMONITOR_UPLOAD_CHECK_CRON=${AGRARMONITOR_UPLOAD_CHECK_CRON:-}
|
||
- AGRARMONITOR_POLLING_DEBUG=${AGRARMONITOR_POLLING_DEBUG:-}
|
||
- APP_URL=${APP_URL:-}
|
||
- DAILY_DIGEST_CRON=${DAILY_DIGEST_CRON:-}
|
||
volumes:
|
||
- /mnt/scans:/mnt/scans
|
||
- /mnt/paperlessmanager:/mnt/data
|
||
networks:
|
||
- paperless-net
|
||
|
||
# ─── Frontend (React + nginx) ──────────────────────────────
|
||
frontend:
|
||
image: gitea.poettker-cloud.de/bjoernpoettker/paperlessmanager-frontend:latest
|
||
build:
|
||
context: ./paperless-frontend
|
||
container_name: paperless-frontend
|
||
restart: unless-stopped
|
||
ports:
|
||
- "${FRONTEND_PORT:-7600}:80"
|
||
environment:
|
||
- VITE_API_URL=
|
||
- PAPERLESS_URL=${PAPERLESS_URL:-http://paperless:8000}
|
||
- VITE_OIDC_AUTHORITY=${VITE_OIDC_AUTHORITY:-https://auth.poettker-holtrup.de/application/o/paperlessmanager/}
|
||
- VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID:-ogOeIlrcsf2spjuwyOc7CuAPrRkRSt3RXfYguoLn}
|
||
- VITE_OIDC_REDIRECT_URI=${VITE_OIDC_REDIRECT_URI:-https://px-7a9b2.poettker-cloud.de/auth/callback}
|
||
networks:
|
||
- paperless-net
|
||
|
||
volumes:
|
||
scanner_data:
|
||
|
||
networks:
|
||
paperless-net:
|
||
driver: bridge
|