From 0d9f3ff4472805bc15cf0d5100cb38fc22548c10 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?= Date: Sat, 31 Oct 2026 15:43:13 +0100 Subject: [PATCH] v0.2.0_docker --- docker/.env.example | 3 +++ docker/README.md | 14 ++++++++++++++ docker/compose-mysql-nfs-opensearch.yml | 1 + docker/compose-postgres-s3-opensearch.yml | 1 + docker/compose-single-sqlite.yml | 1 + 5 files changed, 20 insertions(+) diff --git a/docker/.env.example b/docker/.env.example index a02297f..44d84d9 100644 --- a/docker/.env.example +++ b/docker/.env.example @@ -40,3 +40,6 @@ NFS_EXPORT=/exports/rustbox # A shell-exported COMPOSE_PROJECT_NAME overrides the top-level `name:` field. # Recommended launch commands therefore use `docker compose -p rustbox ...`. COMPOSE_PROJECT_NAME=rustbox + +# development = cookies work over plain HTTP; production = Secure cookies, requires HTTPS +ENVIRONMENT=development diff --git a/docker/README.md b/docker/README.md index 50f126f..ac64204 100644 --- a/docker/README.md +++ b/docker/README.md @@ -121,3 +121,17 @@ Replace all example passwords, S3 credentials and `SESSION_ENCRYPTION_KEY` befor The OpenSearch examples disable its security plugin to keep the local Compose topology self-contained. Production should use TLS/authentication and HTTPS URLs in `search.urls`. The two cluster-ready examples intentionally start one RustBox application container so they can run directly on a single Docker host. For multiple RustBox application nodes, put them behind an external load balancer and do not publish the same host port from every node; SQL, blob storage and OpenSearch must remain shared between the nodes. + +## Sessions and HTTP/HTTPS + +Docker Compose defaults to `ENVIRONMENT=development`. In this mode session cookies do not carry the `Secure` attribute, so login works when RustBox is opened directly over plain HTTP, for example `http://localhost:3009`. + +For a production deployment behind HTTPS set: + +```bash +ENVIRONMENT=production docker compose -p rustbox -f compose-postgres-s3-opensearch.yml up -d --build +``` + +In `production`, RustBox intentionally marks authentication cookies as `Secure`. Opening the application directly over plain HTTP in that mode causes the browser not to send the session cookie and protected requests return `Invalid or expired session`. + +After changing from production/HTTP to development/HTTP, log in again. If the browser still has stale RustBox state, clear cookies/site data for the RustBox origin once and reload. diff --git a/docker/compose-mysql-nfs-opensearch.yml b/docker/compose-mysql-nfs-opensearch.yml index 9f1366e..98ab485 100644 --- a/docker/compose-mysql-nfs-opensearch.yml +++ b/docker/compose-mysql-nfs-opensearch.yml @@ -44,6 +44,7 @@ services: - "${PORT:-3001}:${PORT:-3001}" environment: RUSTBOX_CONFIG: /etc/rustbox/rustbox.toml + ENVIRONMENT: ${ENVIRONMENT:-development} HOST: ${HOST:-0.0.0.0} PORT: ${PORT:-3001} IMAP_HOST: ${IMAP_HOST:-mail.example.com} diff --git a/docker/compose-postgres-s3-opensearch.yml b/docker/compose-postgres-s3-opensearch.yml index 874d2b6..b37bdb4 100644 --- a/docker/compose-postgres-s3-opensearch.yml +++ b/docker/compose-postgres-s3-opensearch.yml @@ -68,6 +68,7 @@ services: - "${PORT:-3001}:${PORT:-3001}" environment: RUSTBOX_CONFIG: /etc/rustbox/rustbox.toml + ENVIRONMENT: ${ENVIRONMENT:-development} HOST: ${HOST:-0.0.0.0} PORT: ${PORT:-3001} IMAP_HOST: ${IMAP_HOST:-mail.example.com} diff --git a/docker/compose-single-sqlite.yml b/docker/compose-single-sqlite.yml index c227786..e16276f 100644 --- a/docker/compose-single-sqlite.yml +++ b/docker/compose-single-sqlite.yml @@ -9,6 +9,7 @@ services: - "${PORT:-3001}:${PORT:-3001}" environment: RUSTBOX_CONFIG: /etc/rustbox/rustbox.toml + ENVIRONMENT: ${ENVIRONMENT:-development} HOST: ${HOST:-0.0.0.0} PORT: ${PORT:-3001} IMAP_HOST: ${IMAP_HOST:-mail.example.com}