docker-compose.yml

services:
  extplorer-init:
    image: ${EXTPLORER_IMAGE_REF:-ghcr.io/soerennb/extplorer3:latest}
    pull_policy: always
    entrypoint: ["/usr/local/bin/init-code"]
    restart: "no"
    user: "0:0"
    environment:
      EXTPLORER_CODE_FORCE: ${EXTPLORER_CODE_FORCE:-0}
      EXTPLORER_FIX_PERMISSIONS: ${EXTPLORER_FIX_PERMISSIONS:-0}
    volumes:
      - extplorer_code:/var/www/html
      - extplorer_writable:/var/www/html/writable
    networks:
      - extplorer-net

  extplorer-app:
    image: ${EXTPLORER_IMAGE_REF:-ghcr.io/soerennb/extplorer3:latest}
    pull_policy: always
    restart: unless-stopped
    user: "82:82"
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    volumes:
      - extplorer_code:/var/www/html:ro
      - extplorer_writable:/var/www/html/writable
    environment:
      CI_ENVIRONMENT: production
      EXTPLORER_WRITE_PATH: /var/www/html/writable
      PHP_INI_SCAN_DIR: /usr/local/etc/php/conf.d
      EXTPLORER_BASE_URL: ${EXTPLORER_BASE_URL:-}
      EXTPLORER_FILE_MANAGER_ROOT: ${EXTPLORER_FILE_MANAGER_ROOT:-}
      EXTPLORER_STATE_DRIVER: ${EXTPLORER_STATE_DRIVER:-file}
      EXTPLORER_SESSION_DRIVER: ${EXTPLORER_SESSION_DRIVER:-file}
      EXTPLORER_CACHE_DRIVER: ${EXTPLORER_CACHE_DRIVER:-file}
      EXTPLORER_CACHE_PREFIX: ${EXTPLORER_CACHE_PREFIX:-extplorer_}
      EXTPLORER_DB_DRIVER: ${EXTPLORER_DB_DRIVER:-}
      EXTPLORER_DB_HOST: ${EXTPLORER_DB_HOST:-}
      EXTPLORER_DB_PORT: ${EXTPLORER_DB_PORT:-}
      EXTPLORER_DB_NAME: ${EXTPLORER_DB_NAME:-}
      EXTPLORER_DB_USER: ${EXTPLORER_DB_USER:-}
      EXTPLORER_DB_PASSWORD_FILE: ${EXTPLORER_DB_PASSWORD_FILE:-}
      EXTPLORER_DB_CHARSET: ${EXTPLORER_DB_CHARSET:-}
      EXTPLORER_DB_COLLATION: ${EXTPLORER_DB_COLLATION:-}
      EXTPLORER_DB_PREFIX: ${EXTPLORER_DB_PREFIX:-}
      EXTPLORER_SESSION_TABLE: ${EXTPLORER_SESSION_TABLE:-ci_sessions}
      EXTPLORER_REDIS_URL: ${EXTPLORER_REDIS_URL:-}
      EXTPLORER_REDIS_HOST: ${EXTPLORER_REDIS_HOST:-}
      EXTPLORER_REDIS_PORT: ${EXTPLORER_REDIS_PORT:-6379}
      EXTPLORER_REDIS_PASSWORD_FILE: ${EXTPLORER_REDIS_PASSWORD_FILE:-}
      EXTPLORER_REDIS_DATABASE: ${EXTPLORER_REDIS_DATABASE:-0}

      # Admin bootstrap is only used when the persistent user store is empty.
      EXTPLORER_ADMIN_USER: ${EXTPLORER_ADMIN_USER:-admin}
      EXTPLORER_ADMIN_PASSWORD_FILE: ${EXTPLORER_ADMIN_PASSWORD_FILE:-}
      EXTPLORER_ADMIN_RESET_PASSWORD: ${EXTPLORER_ADMIN_RESET_PASSWORD:-0}

      EXTPLORER_UPLOAD_MAX_FILE_MB: ${EXTPLORER_UPLOAD_MAX_FILE_MB:-100}
      EXTPLORER_MAX_DOWNLOAD_MB: ${EXTPLORER_MAX_DOWNLOAD_MB:-2048}
      EXTPLORER_MAX_CONTENT_MB: ${EXTPLORER_MAX_CONTENT_MB:-16}
      EXTPLORER_REMOTE_TIMEOUT_SECONDS: ${EXTPLORER_REMOTE_TIMEOUT_SECONDS:-15}
      EXTPLORER_MAX_DIRECTORY_ENTRIES: ${EXTPLORER_MAX_DIRECTORY_ENTRIES:-10000}
      EXTPLORER_MAX_SEARCH_RESULTS: ${EXTPLORER_MAX_SEARCH_RESULTS:-10000}
      EXTPLORER_MAX_OPERATION_SECONDS: ${EXTPLORER_MAX_OPERATION_SECONDS:-120}
      EXTPLORER_WEBDAV_MAX_DEPTH: ${EXTPLORER_WEBDAV_MAX_DEPTH:-1}
      EXTPLORER_ARCHIVE_MAX_ENTRIES: ${EXTPLORER_ARCHIVE_MAX_ENTRIES:-100000}
      EXTPLORER_ARCHIVE_MAX_EXPANDED_MB: ${EXTPLORER_ARCHIVE_MAX_EXPANDED_MB:-2048}
      EXTPLORER_ARCHIVE_MAX_RATIO: ${EXTPLORER_ARCHIVE_MAX_RATIO:-200}
      EXTPLORER_IMAGE_MAX_MB: ${EXTPLORER_IMAGE_MAX_MB:-25}
      EXTPLORER_IMAGE_MAX_PIXELS: ${EXTPLORER_IMAGE_MAX_PIXELS:-40000000}
      EXTPLORER_BACKUP_MAX_MB: ${EXTPLORER_BACKUP_MAX_MB:-102400}
      EXTPLORER_MEMORY_LIMIT: ${EXTPLORER_MEMORY_LIMIT:-256M}
      EXTPLORER_MAX_EXECUTION_TIME: ${EXTPLORER_MAX_EXECUTION_TIME:-120}
      EXTPLORER_MAX_INPUT_TIME: ${EXTPLORER_MAX_INPUT_TIME:-120}
      EXTPLORER_APPLY_ENV: ${EXTPLORER_APPLY_ENV:-0}
      EXTPLORER_MOUNT_ROOT_ALLOWLIST: ${EXTPLORER_MOUNT_ROOT_ALLOWLIST:-}
      # Empty means the persisted administrator setting is authoritative;
      # set 0/1 explicitly to lock the feature at the platform level.
      EXTPLORER_REMOTE_LOGIN_ENABLED: ${EXTPLORER_REMOTE_LOGIN_ENABLED:-}
      EXTPLORER_REMOTE_ENDPOINT_ALLOWLIST: ${EXTPLORER_REMOTE_ENDPOINT_ALLOWLIST:-}
      EXTPLORER_REMOTE_ALLOW_PRIVATE_TARGETS: ${EXTPLORER_REMOTE_ALLOW_PRIVATE_TARGETS:-0}
      EXTPLORER_REMOTE_SECURITY_MODE: ${EXTPLORER_REMOTE_SECURITY_MODE:-strict}
      EXTPLORER_FTPS_CA_FILE: ${EXTPLORER_FTPS_CA_FILE:-}
      EXTPLORER_UPLOAD_SCAN_MODE: ${EXTPLORER_UPLOAD_SCAN_MODE:-off}
      EXTPLORER_UPLOAD_QUARANTINE_MAX_MB: ${EXTPLORER_UPLOAD_QUARANTINE_MAX_MB:-2048}
      EXTPLORER_UPLOAD_QUARANTINE_MAX_FILES: ${EXTPLORER_UPLOAD_QUARANTINE_MAX_FILES:-1000}
      EXTPLORER_UPLOAD_QUARANTINE_TTL_SECONDS: ${EXTPLORER_UPLOAD_QUARANTINE_TTL_SECONDS:-86400}
      EXTPLORER_TRUSTED_PROXY_IPS: ${EXTPLORER_TRUSTED_PROXY_IPS:-}
      EXTPLORER_SESSION_MATCH_IP: ${EXTPLORER_SESSION_MATCH_IP:-0}
      EXTPLORER_HSTS_MAX_AGE: ${EXTPLORER_HSTS_MAX_AGE:-31536000}
      EXTPLORER_HSTS_INCLUDE_SUBDOMAINS: ${EXTPLORER_HSTS_INCLUDE_SUBDOMAINS:-0}
      EXTPLORER_ENCRYPTION_KEY_FILE: ${EXTPLORER_ENCRYPTION_KEY_FILE:-}
      EXTPLORER_EMAIL_PROTOCOL: ${EXTPLORER_EMAIL_PROTOCOL:-}
      EXTPLORER_SMTP_HOST: ${EXTPLORER_SMTP_HOST:-}
      EXTPLORER_SMTP_PORT: ${EXTPLORER_SMTP_PORT:-}
      EXTPLORER_SMTP_USER: ${EXTPLORER_SMTP_USER:-}
      EXTPLORER_SMTP_PASSWORD_FILE: ${EXTPLORER_SMTP_PASSWORD_FILE:-}
      EXTPLORER_SMTP_CRYPTO: ${EXTPLORER_SMTP_CRYPTO:-}
      EXTPLORER_SENDMAIL_PATH: ${EXTPLORER_SENDMAIL_PATH:-}
      EXTPLORER_EMAIL_FROM: ${EXTPLORER_EMAIL_FROM:-}
      EXTPLORER_EMAIL_FROM_NAME: ${EXTPLORER_EMAIL_FROM_NAME:-}
      EXTPLORER_DEFAULT_TRANSFER_EXPIRY: ${EXTPLORER_DEFAULT_TRANSFER_EXPIRY:-}
      EXTPLORER_ALLOW_PUBLIC_UPLOADS: ${EXTPLORER_ALLOW_PUBLIC_UPLOADS:-}
    mem_limit: ${EXTPLORER_APP_MEMORY_LIMIT:-512m}
    cpus: ${EXTPLORER_APP_CPUS:-1.0}
    networks:
      - extplorer-net
    depends_on:
      extplorer-init:
        condition: service_completed_successfully
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "php /var/www/html/current/spark system:readiness >/dev/null && php -r '$$fp=@fsockopen(\"127.0.0.1\",9000); if($$fp){fclose($$fp); exit(0);} exit(1);'",
        ]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 10s

  extplorer-web:
    image: nginx:1.31.3-alpine3.24
    restart: unless-stopped
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - NET_BIND_SERVICE
    tmpfs:
      - /etc/nginx/conf.d
      - /var/cache/nginx
      - /var/run
      - /tmp
    ports:
      - "${EXTPLORER_HTTP_PORT:-8080}:80"
    # The script is bind-mounted from the host. Invoke it through /bin/sh so
    # clean checkouts and filesystems that do not preserve executable bits do
    # not make the web service fail before nginx can validate its config.
    entrypoint: ["/bin/sh", "/usr/local/bin/extplorer-nginx-entrypoint"]
    environment:
      EXTPLORER_UPLOAD_MAX_FILE_MB: ${EXTPLORER_UPLOAD_MAX_FILE_MB:-100}
    mem_limit: ${EXTPLORER_WEB_MEMORY_LIMIT:-128m}
    cpus: ${EXTPLORER_WEB_CPUS:-0.50}
    volumes:
      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf.template:ro
      - ./docker/nginx/entrypoint.sh:/usr/local/bin/extplorer-nginx-entrypoint:ro
      - extplorer_code:/var/www/html:ro
    depends_on:
      extplorer-app:
        condition: service_healthy
    networks:
      - extplorer-net
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/health"]
      interval: 10s
      timeout: 5s
      retries: 6

  extplorer-cleanup:
    image: ${EXTPLORER_IMAGE_REF:-ghcr.io/soerennb/extplorer3:latest}
    pull_policy: always
    profiles: ["worker"]
    restart: unless-stopped
    user: "82:82"
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    entrypoint: ["php"]
    command: ["/var/www/html/current/spark", "shares:cleanup"]
    volumes:
      - extplorer_code:/var/www/html:ro
      - extplorer_writable:/var/www/html/writable
    environment:
      CI_ENVIRONMENT: production
      EXTPLORER_WRITE_PATH: /var/www/html/writable
      EXTPLORER_STATE_DRIVER: ${EXTPLORER_STATE_DRIVER:-file}
      EXTPLORER_CACHE_DRIVER: ${EXTPLORER_CACHE_DRIVER:-file}
      EXTPLORER_CACHE_PREFIX: ${EXTPLORER_CACHE_PREFIX:-extplorer_}
      EXTPLORER_DB_DRIVER: ${EXTPLORER_DB_DRIVER:-}
      EXTPLORER_DB_HOST: ${EXTPLORER_DB_HOST:-}
      EXTPLORER_DB_PORT: ${EXTPLORER_DB_PORT:-}
      EXTPLORER_DB_NAME: ${EXTPLORER_DB_NAME:-}
      EXTPLORER_DB_USER: ${EXTPLORER_DB_USER:-}
      EXTPLORER_DB_PASSWORD_FILE: ${EXTPLORER_DB_PASSWORD_FILE:-}
      EXTPLORER_DB_CHARSET: ${EXTPLORER_DB_CHARSET:-}
      EXTPLORER_DB_COLLATION: ${EXTPLORER_DB_COLLATION:-}
      EXTPLORER_DB_PREFIX: ${EXTPLORER_DB_PREFIX:-}
      EXTPLORER_REDIS_URL: ${EXTPLORER_REDIS_URL:-}
      EXTPLORER_REDIS_HOST: ${EXTPLORER_REDIS_HOST:-}
      EXTPLORER_REDIS_PORT: ${EXTPLORER_REDIS_PORT:-6379}
      EXTPLORER_REDIS_PASSWORD_FILE: ${EXTPLORER_REDIS_PASSWORD_FILE:-}
      EXTPLORER_REDIS_DATABASE: ${EXTPLORER_REDIS_DATABASE:-0}
      EXTPLORER_ENCRYPTION_KEY_FILE: ${EXTPLORER_ENCRYPTION_KEY_FILE:-}
      EXTPLORER_REMOTE_LOGIN_ENABLED: ${EXTPLORER_REMOTE_LOGIN_ENABLED:-}
      EXTPLORER_REMOTE_ENDPOINT_ALLOWLIST: ${EXTPLORER_REMOTE_ENDPOINT_ALLOWLIST:-}
      EXTPLORER_REMOTE_ALLOW_PRIVATE_TARGETS: ${EXTPLORER_REMOTE_ALLOW_PRIVATE_TARGETS:-0}
      EXTPLORER_REMOTE_SECURITY_MODE: ${EXTPLORER_REMOTE_SECURITY_MODE:-strict}
      EXTPLORER_FTPS_CA_FILE: ${EXTPLORER_FTPS_CA_FILE:-}
      EXTPLORER_UPLOAD_SCAN_MODE: ${EXTPLORER_UPLOAD_SCAN_MODE:-off}
      EXTPLORER_UPLOAD_QUARANTINE_MAX_MB: ${EXTPLORER_UPLOAD_QUARANTINE_MAX_MB:-2048}
      EXTPLORER_UPLOAD_QUARANTINE_MAX_FILES: ${EXTPLORER_UPLOAD_QUARANTINE_MAX_FILES:-1000}
      EXTPLORER_UPLOAD_QUARANTINE_TTL_SECONDS: ${EXTPLORER_UPLOAD_QUARANTINE_TTL_SECONDS:-86400}
    depends_on:
      extplorer-init:
        condition: service_completed_successfully
    networks:
      - extplorer-net

networks:
  extplorer-net:
    driver: bridge

volumes:
  extplorer_code:
  extplorer_writable: