loweel/xenomorph repository overview

sudo install -d -o 10001 -g 10001 -m 0750 /srv/xenomorph

docker run --rm -it --user 10001:10001 \
  -v /srv/xenomorph:/var/lib/xenomorph \
  loweel/xenomorph:latest init /var/lib/xenomorph/data

docker run -d --name xenomorph --restart unless-stopped \
  --read-only --user 10001:10001 --cap-drop ALL \
  --security-opt no-new-privileges --tmpfs /tmp:size=16m,mode=1777 \
  -p 8001:8001 \
  -v /srv/xenomorph:/var/lib/xenomorph \
  -e ADMIN_USER=admin \
  -e ADMIN_PASSWORD='choose-a-password' \
  loweel/xenomorph:latest

docker logs -f xenomorph

social.example.com {
	reverse_proxy 127.0.0.1:8001
}

location / {
	proxy_pass http://127.0.0.1:8001;
	proxy_set_header Host $host;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
}

https://social.example.com/admin/admin
         ^ domain            ^ user  ^ control panel

docker restart xenomorph

docker pull loweel/xenomorph:latest
docker rm -f xenomorph
# same docker run as step 2

docker run --rm -it --user 10001:10001 \
  -v /srv/xenomorph:/var/lib/xenomorph \
  loweel/xenomorph:latest upgrade /var/lib/xenomorph/data

sudo install -d -o 10001 -g 10001 -m 0750 /srv/xenomorph/data
sudo install -d -o root  -g root  -m 0755 /srv/xenomorph/config
docker node update --label-add xenomorph=true NODE_NAME
docker network create --driver overlay --attachable traefik_public

docker run --rm -it --user 10001:10001 \
  -v /srv/xenomorph/data:/var/lib/xenomorph \
  loweel/xenomorph:latest init /var/lib/xenomorph/data

sudo cp /srv/xenomorph/data/data/server.json /srv/xenomorph/config/server.json
sudo chmod 0644 /srv/xenomorph/config/server.json

version: "3.8"

services:
  xenomorph:
    image: loweel/xenomorph:latest
    environment:
      XENOMORPH_BASEDIR: /var/lib/xenomorph/data
      XENOMORPH_CONFIG: /etc/xenomorph/server.json
      ADMIN_USER: ${ADMIN_USER:-admin}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
    volumes:
      - type: volume
        source: xenomorph-data
        target: /var/lib/xenomorph
      - type: volume
        source: xenomorph-config
        target: /etc/xenomorph
        read_only: true
    networks:
      - xenomorph
      - traefik_public
    user: "10001:10001"
    tmpfs:
      - /tmp:size=16m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 30s
    healthcheck:
      test: ["CMD", "xenomorph", "state", "/var/lib/xenomorph/data"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik_public"
        - "traefik.http.routers.xenomorph.rule=Host(`social.example.com`)"
        - "traefik.http.routers.xenomorph.entrypoints=web"
        - "traefik.http.routers.xenomorph.service=xenomorph-svc"
        - "traefik.http.services.xenomorph-svc.loadbalancer.server.port=8001"
      placement:
        constraints:
          - node.labels.xenomorph == true
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 5
        window: 60s
      update_config:
        parallelism: 1
        order: stop-first
        failure_action: rollback

networks:
  xenomorph:
    driver: overlay
  traefik_public:
    external: true

volumes:
  xenomorph-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /srv/xenomorph/data
  xenomorph-config:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /srv/xenomorph/config

export ADMIN_USER=admin
export ADMIN_PASSWORD='choose-a-password'

docker stack deploy --compose-file xenomorph.yml --resolve-image always xenomorph
docker service logs -f xenomorph_xenomorph
docker service update --force xenomorph_xenomorph   # after editing server.json