Waldson Patrício
217efdace1
Run an always-on Syncthing peer on the droplet as an off-site copy for the owner's folders. New syncthing/ compose stack on proxy_net: the sync protocol is published on host 22000 (tcp+udp) for direct device connections, while the GUI (8384) is unpublished and reached only through the central Caddy, which gains a sync.waldson.com.br reverse-proxy block. Config and folder data live on a host bind mount for SSH inspection and are git-ignored. README documents the deploy, upgrade, and interactive pairing runbook. Binding the GUI to a non-loopback address (STGUIADDRESS) also disables Syncthing's DNS-rebinding host check, so the proxy needs no Host rewrite.
40 lines
1.6 KiB
YAML
40 lines
1.6 KiB
YAML
name: syncthing
|
|
|
|
# Always-on Syncthing peer and off-site copy for the owner's folders. The web
|
|
# GUI is reachable only through the central Caddy proxy on proxy_net (the GUI
|
|
# port is never published); the sync protocol is published directly on host
|
|
# 22000 so devices connect to the droplet without going through relays. See
|
|
# README.md for the deploy, upgrade, and pairing runbook.
|
|
|
|
services:
|
|
syncthing:
|
|
image: syncthing/syncthing:latest
|
|
restart: unless-stopped
|
|
hostname: droplet
|
|
environment:
|
|
# Own the bind-mounted files as the droplet's deploy user so synced data
|
|
# is inspectable and manageable over plain SSH.
|
|
PUID: "1000"
|
|
PGID: "1000"
|
|
# Bind the GUI to all interfaces inside the container so Caddy can reach
|
|
# it over proxy_net. The port is deliberately not published to the host;
|
|
# Syncthing's own credentials are the only thing guarding this surface.
|
|
STGUIADDRESS: "0.0.0.0:8384"
|
|
volumes:
|
|
# Config (device keys, folder list) and all folder data live here, on a
|
|
# host bind mount, so everything survives recreation and is visible over
|
|
# SSH. Git-ignored via the repo's data/ rule.
|
|
- ./data:/var/syncthing
|
|
ports:
|
|
# Sync protocol only. Device IDs authenticate the protocol, so exposing
|
|
# this publicly is safe by design. No local-discovery port (21027/udp) is
|
|
# published: it is useless on a public server with no LAN peers.
|
|
- "22000:22000/tcp"
|
|
- "22000:22000/udp"
|
|
mem_limit: 512m
|
|
networks:
|
|
- proxy_net
|
|
|
|
networks:
|
|
proxy_net:
|
|
external: true
|