From d0280ad3bdc9c1f25e65f38496a9af0c5d1be36b Mon Sep 17 00:00:00 2001 From: claude-macmini Date: Sun, 13 Sep 2026 18:57:30 +0200 Subject: [PATCH] Activepieces 0.90.4 als Coolify-compose op de derden-box (infra#77) Co-Authored-By: Claude Opus 5 --- README.md | 31 +++++++++++++ docker-compose.yml | 106 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 137 insertions(+) create mode 100644 README.md create mode 100644 docker-compose.yml diff --git a/README.md b/README.md new file mode 100644 index 0000000..c54406f --- /dev/null +++ b/README.md @@ -0,0 +1,31 @@ +# activepieces — automatiserings-/koppellaag (derden-box) + +Compose-definitie voor [Activepieces](https://www.activepieces.com) (MIT, community-editie) op de +derden-box, gedraaid als **Coolify docker-compose (git-based)** — géén route B (geen registry-image, +geen CI, geen host-watcher). Coolify klont deze repo en draait `docker compose up`. +Tracking-issue: `wSFcQyxBu1/infra#77`. Beheer, sleutelbos-regels, koppel- en rotatierecept: +infra-runbook `runbooks/activepieces-derden-box.md`. + +## Wat er staat +- `docker-compose.yml` — drie services met **exact gepinde tags**: + `activepieces/activepieces:0.90.4` (app + embedded worker), `pgvector/pgvector:0.8.0-pg16`, + `redis:7.4.11-alpine`. PG/Redis alleen op het privé net; alleen de app op `coolify` (Traefik). + Geen `ports:`. Named volumes: `postgres-data`, `redis-data`, `activepieces-cache`. +- Secrets staan **niet** hier: `AP_ENCRYPTION_KEY`, `AP_JWT_SECRET`, `AP_POSTGRES_PASSWORD`, + `AP_SMTP_*` en `AP_FRONTEND_URL` komen uit de Coolify-env (off-box kopie + `~/.config/doc-gen-deploy/activepieces.env` op de Mac Mini + wachtwoordmanager eigenaar). + +## Updaten +1. Nieuwe tag op Docker Hub (`activepieces/activepieces`) + [release notes](https://github.com/activepieces/activepieces/releases); + check of de upstream `docker-compose.yml`/env-namen zijn gewijzigd. +2. Bump de tag(s) hier, commit + push naar `main`. +3. Redeploy de Coolify-app (API `GET /deploy?uuid=` via docgen, of de UI). De app migreert zelf bij boot. +4. Verifieer: `curl -s -o /dev/null -w '%{http_code}\n' https://flows.2487.eu/` → `401` (basic-auth-poort dicht), + met creds → `200`; `/api/v1/health` (met creds) → `200`. + +## Vaste keuzes (waarom) +- `AP_EXECUTION_MODE=SANDBOX_CODE_ONLY`: Code-stappen in een V8-isolate, zónder privileged container. +- `AP_NETWORK_MODE=STRICT`: flow-code kan RFC1918/loopback/metadata niet bereiken (PG/Redis dus ook niet). +- `AP_TELEMETRY_ENABLED=false`, `AP_ALLOW_OPEN_SIGN_UP=false`, run-data-retentie 7 dagen. +- Admin-UI staat achter een Traefik-basic-auth-poort op de box (lockdown-patroon); inkomende webhooks + zijn daardoor bewust (nog) niet bereikbaar — polling-/schedule-flows alleen. diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..d2b4c31 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,106 @@ +# Activepieces — automatiserings-/koppellaag (derden-box, Coolify docker-compose-from-git; infra#77) +# Topologie volgt het OpnForm-/Miniflux-patroon (runbook opnform-cx33.md §4 gotcha 6): +# - postgres / redis : ALLEEN op het privé 'default'-net, geen host-poort. +# - activepieces : op 'default' (PG/Redis) ÉN op 'coolify' (Traefik). Geen 'ports:'. +# Updaten = tags bumpen → push → Coolify redeploy (geen route B, geen watcher). Zie README.md. +# Secrets komen uitsluitend uit de Coolify-env (${VAR}); deze compose bevat er geen. + +services: + activepieces: + image: activepieces/activepieces:0.90.4 + restart: unless-stopped + mem_limit: 1g # RAM-guardrail derden-box (infra#77); app + embedded worker (WORKER_AND_APP) + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_healthy + environment: + # --- identiteit / URL --- + AP_FRONTEND_URL: ${AP_FRONTEND_URL} + AP_ENVIRONMENT: prod + AP_EDITION: ce + AP_CONTAINER_TYPE: WORKER_AND_APP + # --- geheimen (Coolify-env; off-box in ~/.config/doc-gen-deploy/activepieces.env) --- + AP_ENCRYPTION_KEY: ${AP_ENCRYPTION_KEY} # 32 hex; versleutelt de connections — NOOIT roteren zonder migratie + AP_JWT_SECRET: ${AP_JWT_SECRET} + # --- database / queue (privé net) --- + AP_DB_TYPE: POSTGRES + AP_POSTGRES_HOST: postgres + AP_POSTGRES_PORT: "5432" + AP_POSTGRES_DATABASE: activepieces + AP_POSTGRES_USERNAME: activepieces + AP_POSTGRES_PASSWORD: ${AP_POSTGRES_PASSWORD} + AP_REDIS_TYPE: STANDALONE + AP_REDIS_HOST: redis + AP_REDIS_PORT: "6379" + AP_QUEUE_UI_ENABLED: "false" + # --- uitvoering (docs: production-setup) --- + AP_EXECUTION_MODE: SANDBOX_CODE_ONLY # V8-isolate per Code-stap, unprivileged (geen CAP_SYS_ADMIN) + AP_WORKER_CONCURRENCY: "1" + AP_REUSE_SANDBOX: "true" + AP_NETWORK_MODE: STRICT # SSRF-guard: flow-code kan geen RFC1918/loopback/metadata bereiken + AP_FLOW_TIMEOUT_SECONDS: "600" + AP_TRIGGER_DEFAULT_POLL_INTERVAL: "5" + AP_EXECUTION_DATA_RETENTION_DAYS: "7" # #77: retentie kort (run-data bevat de verwerkte inhoud) + AP_PAUSED_FLOW_TIMEOUT_DAYS: "7" # mag de retentie niet overschrijden (validator) + # --- soevereiniteit / toegang --- + AP_TELEMETRY_ENABLED: "false" # PostHog (us.i.posthog.com) uit + AP_ALLOW_OPEN_SIGN_UP: "false" # na de eerste admin alleen op uitnodiging (default, expliciet) + # --- platform-mail (uitnodigingen e.d.) via Stalwart, 587 = STARTTLS (465 is bij Hetzner dicht) --- + AP_SMTP_HOST: mail.2487.eu + AP_SMTP_PORT: "587" + AP_SMTP_USERNAME: ${AP_SMTP_USERNAME} + AP_SMTP_PASSWORD: ${AP_SMTP_PASSWORD} + AP_SMTP_SENDER_EMAIL: ${AP_SMTP_USERNAME} # afzender = auth-account (Stalwart 501-les) + AP_SMTP_SENDER_NAME: Activepieces + volumes: + - activepieces-cache:/usr/src/app/cache # pieces-cache (npm-archieven); herbouwbaar + expose: + - "80" + labels: + # Traefik moet het 'coolify'-net kiezen (multi-netwerk-service; OpnForm gotcha 8) + - "traefik.docker.network=coolify" + networks: + - default + - coolify + + postgres: + image: pgvector/pgvector:0.8.0-pg16 # upstream-keuze (vector-extensie optioneel; postgres 16) + restart: unless-stopped + mem_limit: 256m + environment: + POSTGRES_DB: activepieces + POSTGRES_USER: activepieces + POSTGRES_PASSWORD: ${AP_POSTGRES_PASSWORD} + volumes: + - postgres-data:/var/lib/postgresql/data + healthcheck: + test: ["CMD", "pg_isready", "-U", "activepieces", "-d", "activepieces"] + interval: 10s + timeout: 5s + retries: 5 + # geen 'networks:' → alleen 'default' (privé) + + redis: + image: redis:7.4.11-alpine + restart: unless-stopped + mem_limit: 128m + command: ["redis-server", "--appendonly", "yes", "--maxmemory", "96mb", "--maxmemory-policy", "noeviction"] + volumes: + - redis-data:/data + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 10s + timeout: 5s + retries: 5 + # geen 'networks:' → alleen 'default' (privé) + +volumes: + activepieces-cache: + postgres-data: + redis-data: + +networks: + coolify: + external: true