docker-compose.yml

name: controlr

### Environment Variables Configuration ###
# This configuration uses environment variables to supply secrets to services.
# All sensitive values should be provided via the host's environment variables or .env file.
#
# Quick Start:
# 1. Set environment variables for all sensitive values (e.g., ControlR_POSTGRES_USER, ControlR_POSTGRES_PASSWORD)
# 2. Or create a .env file with the required variables
# 3. Run: sudo docker compose up -d
#
# See the README.md for more information on configuration options.

# These values are expected to be passed in by the host's environment or .env file.
x-postgres-user: &pgUser ${ControlR_POSTGRES_USER:?error}
x-postgres-password: &pgPassword ${ControlR_POSTGRES_PASSWORD:?error}
x-aspire-browser-token: &aspireToken ${ControlR_ASPIRE_BROWSER_TOKEN:?error}

# This should be set to the public base URL of the server (e.g. "https://controlr.example.com").
# When unset, the actions that need an outbound link refuse instead of failing to start.
x-public-base-url: &publicBaseUrl ""

# The public URL where the Aspire Dashboard will be accessible via browser.
# For example, if your reverse proxy is set up to route https://metrics.example.com
# to Aspire, that is the URL you should use here.
x-aspire-public-url: &aspirePublicUrl "http://localhost:18888"

services:
  controlr:
    # It's recommended to change 'latest' to a specific version tag and update manually.
    image: bitbound/controlr:latest
    container_name: controlr
    restart: unless-stopped
    depends_on:
      - postgres
      - aspire
    ports:
      - "5120:8080"
    networks:
      - controlr-network
    environment:
      # ASPNETCORE variables should not be changed.
      ASPNETCORE_ENVIRONMENT: Production
      ASPNETCORE_HTTP_PORTS: 8080

      # Postgres connection details.
      ControlR_POSTGRES_PORT: 5432
      ControlR_POSTGRES_HOST: "postgres"
      ControlR_POSTGRES_USER: *pgUser
      ControlR_POSTGRES_PASSWORD: *pgPassword
      ControlR_POSTGRES_DB: "controlr"

      # Set to true to authenticate to Azure Database for PostgreSQL using Entra ID
      # instead of password authentication. Requires DefaultAzureCredential chain.
      # ControlR_POSTGRES_USE_ENTRA_ID: false

      # Whether to enable the configuration provider for Docker Secrets.
      ControlR_AppOptions__EnableDockerSecrets: false

      # The access token for the Aspire Dashboard, where server logs and telemetry can be viewed.
      #ControlR_AspireDashboard__Token: *aspireToken

      # The public URL for the Aspire Dashboard's web interface.
      ControlR_AspireDashboard__PublicWebUrl: *aspirePublicUrl

      # Enables CORS middleware and restricts requests to allowed origins.
      ControlR_AppOptions__EnableCors: false

      # Origins allowed when CORS is enabled.
      #ControlR_AppOptions__CorsAllowedOrigins__0: "https://example.com"

      # Whether to make self-registration permanently publicly available.
      # When enabled, anyone can create an account without an invitation, regardless of how
      # many users already exist. Use this for public demo or evaluation deployments.
      # Independent of DisableFirstUserSelfRegistration, which disables the one-time bootstrap
      # that auto-disables after the first user is created.
      ControlR_AppOptions__EnablePublicRegistration: false

      # The public URL of this server, e.g. "https://controlr.example.com".  Used to build links
      # that leave this server, such as emailed password reset and confirmation links, device access
      # URLs, and tenant invites.  It is also the origin a target device dials for a relay session,
      # so the devices must be able to reach it too.  Include the scheme and, if non-standard, the
      # port.  No path, query, or fragment.  While it is unset, the actions that need such a link
      # refuse and relay sessions fall back to the address the viewing browser used.
      ControlR_AppOptions__PublicBaseUrl: *publicBaseUrl

      # The hostnames this server answers to.  Semicolon-separated, without port numbers.  A pinned list
      # makes the server answer 400 to any other Host before the request reaches the application, so it is
      # worth setting once the deployment is known.  The shipped "*" accepts every host instead.  Neither
      # choice weakens the links this server sends out, because those are built only from
      # ControlR_AppOptions__PublicBaseUrl and never from the arriving host.
      ControlR_AllowedHosts: "*"

      # DEVELOPMENT AND LOAD TESTING ONLY.  Never enable this on a server that users can reach.
      # Lets agents register themselves without an installer key.  The agent hub authenticates a device
      # by the public key already stored for it, and this setting is what allows a key to be adopted for
      # a device the server has never seen.  Turning it on changes the security posture of the whole hub
      # surface, and the server prints a warning at startup while it stays on.
      ControlR_DeveloperOptions__AllowAgentsToSelfBootstrap: false

      # Controls the one-time first-user self-registration behavior.
      # By default, public registration is available only while the server has zero users;
      # it is automatically disabled once the first user is created. The first user created
      # through this flow is promoted to server administrator and first-tenant admin.
      # Set this to true to disable the bootstrap entirely. Existing installations without
      # this key set retain the prior behavior (self-registration enabled).
      # Independent of EnablePublicRegistration, which controls ongoing open signup.
      ControlR_AppOptions__DisableFirstUserSelfRegistration: false

      # The number of days to retain installer key usage history.
      # Usage entries older than this are excluded from installer key history queries and cleaned up by a background service.
      # Set this to 0 or a negative value to disable history expiration.
      ControlR_AppOptions__AgentInstallerKeyHistoryDays: 90

      # Number of days after which service account credentials that were revoked or expired are
      # permanently deleted from the database by a background service. Applies to both server-scoped
      # and tenant-scoped credentials. Set to 0 or less to disable automatic deletion.
      # Credentials can also be deleted manually from the service accounts pages at any time.
      ControlR_AppOptions__ServiceAccountCredentialCleanupAfterDays: 30

      # The maximum allowed time difference between the agent's signed timestamp and the server's
      # current time. If the difference exceeds this value, the agent's connection request is rejected.
      # Set to null to disable timestamp verification. For most deployments, 30-60 seconds is
      # recommended to balance between allowing legitimate clock skew and limiting replay attacks.
      ControlR_AppOptions__AgentClockSkewTolerance: "00:01:00"

      # The name that appears in TOTP authenticator apps.
      ControlR_AppOptions__AuthenticatorIssuerName: "ControlR"

      # Enables the interactive bearer-token login flow exposed through ASP.NET Core Identity API endpoints.
      # This is useful for logging in from desktop clients or other clients where cookies aren't ideal.
      ControlR_AppOptions__EnableInteractiveBearerLogin: false

      # Lifetime of interactive bearer access tokens issued by ASP.NET Core Identity.
      ControlR_AppOptions__InteractiveBearerTokenExpirationMinutes: 60

      # Lifetime of refresh tokens issued by ASP.NET Core Identity for interactive bearer logins.
      ControlR_AppOptions__InteractiveRefreshTokenExpirationDays: 30

      # If enabled, signing in with a passkey will effectively add the "remember me" option.
      ControlR_AppOptions__PersistPasskeyLogin: false

      # Automatically obtain Cloudflare IPs from https://www.cloudflare.com/ips-v4
      # and add them to the KnownNetworks list for forwarded headers.
      ControlR_AppOptions__EnableCloudflareProxySupport: false

      # Enables detailed error messages from Entity Framework Core when database errors occur.
      # This can be helpful for debugging but may leak sensitive information, so it is disabled by default.
      # Enabling this incurs a small performance cost.
      ControlR_AppOptions__EnableDatabaseDetailedErrors: false


      # When enabled, bypasses KnownProxies/KnownIpNetworks checks and trusts all forwarded headers
      # from the reverse proxy.  Only enable this in secure environments where the reverse proxy
      # is guaranteed to be the only source of incoming traffic.
      ControlR_AppOptions__EnableNetworkTrust: false

      # Add an Azure Monitor connection string to enable exporting of OpenTelemetry data to Azure.
      #ControlR_AzureMonitor__ConnectionString:

      # Add an OTLP endpoint URL to enable exporting of OpenTelemetry data to an OTLP endpoint.
      ControlR_OTLP_ENDPOINT_URL: "http://aspire:18889"

      # Set the minimum level for logs sent to OTLP exporter and/or Azure Monitor.
      ControlR_Logging__LogLevel__Default: Information

      # The log level for ASP.NET Core framework logs.  Setting this to Warning or higher can help reduce noise in logs.
      ControlR_Logging__LogLevel__Microsoft.AspNetCore: Warning

      # The log level to use for HttpLogging middleware (when it's enabled).
      ControlR_Logging__LogLevel__Microsoft.AspNetCore.HttpLogging: Information

      # The log level for ForwardedHeadersMiddleware, among others. When set to debug,
      # this will log when a reverse proxy isn't trusted, which can help troubleshoot misconfigurations.
      ControlR_Logging__LogLevel__Microsoft.AspNetCore.HttpOverrides: Debug

      # The log level for Entity Framework Core database operations.
      # Setting this to Information or Debug can help troubleshoot database issues, but can spam logs.
      ControlR_Logging__LogLevel__Microsoft.EntityFrameworkCore.Database: Warning

      # For debugging.  When enabled, extra logs will be written for all HTTP requests and responses.
      # https://learn.microsoft.com/en-us/aspnet/core/fundamentals/http-logging
      ControlR_AppOptions__UseHttpLogging: false

      # If enabled, detailed errors will be sent to the SignalR client when exceptions occur during hub method invocations.
      # This can be helpful for debugging but may leak sensitive information, so it is disabled by default.
      ControlR_AppOptions__EnableSignalrDetailedErrors: false

      # When enabled, the Scalar UI endpoint for exploring the OpenAPI document is served.
      # Recommended for development/debugging; disable in production.
      ControlR_AppOptions__EnableScalarUi: false

      # *DANGEROUS* When true, agents will automatically uninstall themselves when they connect.
      # Use this before permanently taking down a server to ensure agents are removed from remote machines.
      ControlR_ServerLifecycle__DecommissionServer: false

      # Configure X.509 certificate-based encryption for Data Protection keys at rest.
      # If false, keys are not encrypted (not recommended for production).
      # When true, Data Protection keys will be encrypted using the certificate specified below.
      # An exception will be thrown at startup if the certificate is not configured or doesn't exist.
      ControlR_KeyProtectionOptions__EncryptKeys: false

      # The file path to a PFX (.pfx) certificate file for key encryption.
      # Mount the certificate file into the container and provide the container path here.
      #ControlR_KeyProtectionOptions__CertificatePath:

      # An alternative means of supplying the certificate.  It should be the
      # base64-encoded contents of the PFX file If this is set, it will
      # override CertificatePath.
      #ControlR_KeyProtectionOptions__CertificateContentsBase64:

      # The password for the PFX certificate file (if password-protected).
      # Leave empty if the PFX file has no password.
      #ControlR_KeyProtectionOptions__CertificatePassword:

      # The Gateway IP here must match the IP address used by the Docker gateway.
      ControlR_AppOptions__DockerGatewayIp: "::ffff:172.29.0.1"

      # When enabled, uses an in-memory database instead of PostgreSQL.
      # Primarily used for testing and development environments.
      ControlR_AppOptions__UseInMemoryDatabase: false

      # The name of the in-memory database to use when UseInMemoryDatabase is enabled.
      # Primarily used for testing and development environments.
      ControlR_AppOptions__InMemoryDatabaseName: ""

      # The maximum allowed file size for transfers in the remote File System component.
      # Set to 0 or less for no limit.  Default is 100MB.
      ControlR_AppOptions__MaxFileTransferSize: 104857600

      # Whether users must confirm their email address before being allowed to log in.
      # If true, you must also configure SMTP settings below.
      ControlR_AppOptions__RequireUserEmailConfirmation: true
      # Whether each user must have a unique email address.
      ControlR_AppOptions__RequireUserUniqueEmail: true

      # Disable all email sending from the application.
      ControlR_AppOptions__DisableEmailSending: false

      # The default theme mode for unauthenticated users ("Dark" or "Light").
      # Authenticated users have their own per-user theme preference.
      ControlR_AppOptions__DefaultThemeMode: "Dark"

      # When enabled, the Desktop Preview button is hidden on the Remote Control page
      # and the desktop preview endpoint refuses to serve requests.
      ControlR_AppOptions__DisableDesktopPreview: false

      # When enabled, only the device access pages remain visible. All other UI routes,
      # including the Identity account pages, render a not-found view. API endpoints are unaffected.
      ControlR_AppOptions__DisableMainUi: false

      # SMTP settings are used for sending account-related emails, such as
      # account confirmation and password reset emails.  As of this writing,
      # emails are only used for Microsoft's Identity system.
      ControlR_AppOptions__SmtpDisplayName: ""
      ControlR_AppOptions__SmtpEmail: ""
      ControlR_AppOptions__SmtpHost: ""
      ControlR_AppOptions__SmtpLocalDomain: ""
      ControlR_AppOptions__SmtpCheckCertificateRevocation: true
      ControlR_AppOptions__SmtpPassword: ""
      ControlR_AppOptions__SmtpPort: 587
      ControlR_AppOptions__SmtpUserName: ""

      # Uncomment and add an entry for each proxy that will be forwarding traffic
      # to ControlR.  The app will not work correctly if this isn't done or if the
      # forwarded headers are not in the correct format.
      # See the docs for more details:
      # https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer
      #ControlR_AppOptions__KnownProxies__0:

      #ControlR_AppOptions__KnownNetworks__0:

      # To enable Microsoft account login, create an App Registration in Azure and
      # set the values below. Instructions can be found here:
      # https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/microsoft-logins
      #ControlR_AppOptions__MicrosoftClientId: ""
      #ControlR_AppOptions__MicrosoftClientSecret: ""

      # To enable GitHub login, create an OAuth app in GitHub set the values below.
      # Instructions can be found here:
      # https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps
      #ControlR_AppOptions__GitHubClientId: ""
      #ControlR_AppOptions__GitHubClientSecret: ""

      # Bootstrap an admin user on first startup (only when no users exist).
      # Provide email, password, and optionally a PAT for API access.
      #ControlR_Bootstrap__AdminEmail: "admin@example.com"
      #ControlR_Bootstrap__AdminPassword: "change-me-now"
      #ControlR_Bootstrap__AdminPatTokenId: "11111111-2222-3333-4444-555555555555"
      #ControlR_Bootstrap__AdminPatSecret: "a-very-strong-and-long-pat-secret-key"

      # Bootstrap a server-scoped service account on first startup.
      # Provide a name and description, and optionally a pre-assigned account ID, token ID, and secret.
      # The resulting x-api-key header value is {hex-guid}:{ServerServiceAccountTokenSecret}.
      #ControlR_Bootstrap__ServerServiceAccountName: "server-svc"
      #ControlR_Bootstrap__ServerServiceAccountDescription: "Server-scoped service account for inter-service communication"
      #ControlR_Bootstrap__ServerServiceAccountId: "11111111-2222-3333-4444-777777777777"
      #ControlR_Bootstrap__ServerServiceAccountTokenId: "11111111-2222-3333-4444-666666666666"
      #ControlR_Bootstrap__ServerServiceAccountTokenSecret: "a-very-strong-and-long-service-account-secret"

  postgres:
    image: postgres:18
    container_name: postgres
    restart: unless-stopped
    expose:
      - "5432"
    networks:
      - controlr-network
    volumes:
      - controlr-data:/var/lib/postgresql
    environment:
      POSTGRES_USER: *pgUser
      POSTGRES_PASSWORD: *pgPassword
      POSTGRES_DB: controlr

  aspire:
    image: mcr.microsoft.com/dotnet/aspire-dashboard:latest
    container_name: aspire
    restart: unless-stopped
    ports:
      - "18888:18888"
    expose:
      - "18889"
    networks:
      - controlr-network
    environment:
      Dashboard__Frontend__BrowserToken: *aspireToken
      Dashboard__Frontend__PublicUrl: *aspirePublicUrl

volumes:
  controlr-data:
    name: "controlr-data"

networks:
  controlr-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.29.0.0/16
          gateway: 172.29.0.1