Sam Rolfe
2ed0ca80ae
- Weblog desktops were unauthenticated and publicly reachable (entry vector) - Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified - Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth) - GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined - Removed /home/sam:ro mount from GIMP (was exposing secrets to the container) - Service-controller restarted (was dead, which is why toggles did nothing) - Incident record + captured payload in docs/incident-2026-11-11*
44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
# Music DAW containers (LinuxServer webtop desktop in the browser).
|
|
# Deploy on .13 at /home/sam/Docker/Containers/music/ (this repo folder `music/`).
|
|
# docker compose build (builds music-lmms from music/lmms/)
|
|
# docker compose up -d
|
|
name: music
|
|
|
|
services:
|
|
lmms:
|
|
build: ./lmms
|
|
image: music-lmms:latest
|
|
container_name: lmms
|
|
restart: unless-stopped
|
|
environment:
|
|
CUSTOM_USER: ${WEBTOP_USER:-family}
|
|
PASSWORD: ${WEBTOP_PASSWORD}
|
|
PUID: 1000
|
|
PGID: 100
|
|
TZ: Australia/Perth
|
|
# Clamp the virtual screen. The webtop default (15360x8640) allocated a
|
|
# ~570MB Xvfb framebuffer per pixel-plane; 2560x1440 drops that to ~14MB.
|
|
# KasmVNC upscales the desktop to fit the browser, so it stays usable.
|
|
MAX_RES: 2560x1440
|
|
ports:
|
|
- "8085:3000"
|
|
volumes:
|
|
- ./lmms-config:/config
|
|
- /mnt/data/family-home-lab/shared-media:/media:ro
|
|
shm_size: 1gb
|
|
logging:
|
|
driver: json-file
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
# Zrythm added after its image is prepared (music/zrythm).
|
|
# zrythm:
|
|
# build: ./zrythm
|
|
# image: music-zrythm:latest
|
|
# container_name: zrythm
|
|
# restart: unless-stopped
|
|
# environment: { PUID: 1000, PGID: 100, TZ: Australia/Perth }
|
|
# ports: ["8086:3000"]
|
|
# volumes:
|
|
# - ./zrythm-config:/config
|
|
# - /mnt/data/family-home-lab/shared-media:/media:ro
|
|
# shm_size: 1gb |