mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-08-04 07:02:13 +00:00
552da3ca84
Choosing Gotenberg in ./devenv started the `pdf` sidecar and configured nothing else, so the app still defaulted to dompdf. Pointing it at the sidecar by hand then hit the SSRF guard, because `pdf` resolves to a private address on the compose network — the failure #691 fixed, hit from inside our own dev environment. The three gotenberg compose files now set PDF_DRIVER, GOTENBERG_HOST and GOTENBERG_ALLOWED_PRIVATE_HOST on php-fpm, so the stack renders through the sidecar with no .env editing at all. The serversideup pool config already sets `clear_env = no`, so these reach the workers; verified by generating a real invoice PDF end to end (24967 bytes, %PDF-1.4). Setting the environment in compose rather than writing to .env keeps the devenv script from mutating a developer's own file — it does not touch .env today, and the values belong to the compose file the developer selected. Non-Docker setups have the same keys documented in .env.example. devenv now prints what it configured, including that the compose file exempts that one host from the SSRF guard, since a security control being relaxed should not be silent.
87 lines
2.0 KiB
YAML
87 lines
2.0 KiB
YAML
services:
|
|
php-fpm:
|
|
container_name: invoiceshelf-dev-php
|
|
build:
|
|
context: ../../
|
|
dockerfile: docker/development/Dockerfile
|
|
args:
|
|
- UID=${USRID:-1000}
|
|
- GID=${GRPID:-1000}
|
|
target: development
|
|
environment:
|
|
# Gotenberg runs as the `pdf` service below, on this compose network, so
|
|
# its host resolves to a private address. PrivateNetworkGuard rejects those
|
|
# by default — naming the exact host is what exempts it, and only it.
|
|
- PDF_DRIVER=gotenberg
|
|
- GOTENBERG_HOST=http://pdf:3000
|
|
- GOTENBERG_ALLOWED_PRIVATE_HOST=http://pdf:3000
|
|
volumes:
|
|
- ../../:/var/www/html
|
|
networks:
|
|
- invoiceshelf-dev
|
|
|
|
nginx:
|
|
container_name: invoiceshelf-dev-nginx
|
|
build:
|
|
context: ../../
|
|
dockerfile: docker/development/nginx.Dockerfile
|
|
environment:
|
|
- "PHP_FPM_HOST=php-fpm:9000"
|
|
ports:
|
|
- '80:80'
|
|
volumes:
|
|
- ../../:/var/www/html
|
|
networks:
|
|
invoiceshelf-dev:
|
|
aliases:
|
|
- invoiceshelf.test
|
|
|
|
db:
|
|
image: mariadb:10.9
|
|
container_name: invoiceshelf-dev-mysql
|
|
environment:
|
|
MYSQL_ROOT_PASSWORD: invoiceshelf
|
|
MYSQL_DATABASE: invoiceshelf
|
|
MYSQL_USER: invoiceshelf
|
|
MYSQL_PASSWORD: invoiceshelf
|
|
ports:
|
|
- "3306:3306"
|
|
volumes:
|
|
- invoiceshelf-dev-mysql:/var/lib/mysql
|
|
networks:
|
|
- invoiceshelf-dev
|
|
|
|
adminer:
|
|
container_name: invoiceshelf-dev-adminer
|
|
build:
|
|
context: ../../
|
|
dockerfile: docker/development/adminer/Dockerfile
|
|
environment:
|
|
ADMINER_PLUGINS: tables-filter
|
|
ADMINER_DESIGN: konya
|
|
ports:
|
|
- '8080:8080'
|
|
networks:
|
|
- invoiceshelf-dev
|
|
|
|
mail:
|
|
container_name: invoiceshelf-dev-mailpit
|
|
image: axllent/mailpit:latest
|
|
restart: always
|
|
ports:
|
|
- 1025:1025
|
|
- 8025:8025
|
|
networks:
|
|
- invoiceshelf-dev
|
|
|
|
pdf:
|
|
image: gotenberg/gotenberg:8
|
|
networks:
|
|
- invoiceshelf-dev
|
|
|
|
networks:
|
|
invoiceshelf-dev:
|
|
|
|
volumes:
|
|
invoiceshelf-dev-mysql:
|