docker-compose.yml

# Password Pusher - Docker Compose

x-env: &x-env
  environment:
    # --- Overview ---
    # Sensible defaults are set below; the app runs out of the box. Uncomment and set
    # any option to customize your deployment.
    #
    # All configuration options below are described in more detail in the Password Pusher Configuration documentation:
    # https://docs.pwpush.com/docs/self-hosted-configuration/

    # --- Security & TLS ---
    # PWPUSH_MASTER_KEY: This sets the encryption key for the database. If omitted, a default encryption key is used.
    # For production, generate your own key and set it here so encrypted pushes use your key.
    # Generate a new key here: https://us.pwpush.com/generate_key
    # PWPUSH_MASTER_KEY: ""
    #
    # TLS_DOMAIN: For automatic TLS/SSL (e.g. HTTPS via Let's Encrypt), create a DNS record that
    #   points to this host, then set this env var to that domain (e.g. pwpush.example.com).
    #   The container will provision and renew certificates automatically.
    # TLS_DOMAIN: ""

    # --- Features ---
    PWP__ENABLE_URL_PUSHES: "true"
    PWP__ENABLE_FILE_PUSHES: "true"
    PWP__ENABLE_QR_PUSHES: "true"
    PWP__ALLOW_ANONYMOUS: "true"

    # --- Deployment & URL ---
    # PWP__HOST_DOMAIN: ""
    # PWP__HOST_PROTOCOL: "https"
    # PWP__OVERRIDE_BASE_URL: ""
    # PWP__ALLOWED_HOSTS: ""
    # PWP__TRUSTED_PROXIES: ""
    # PWP__CLOUDFLARE_PROXY: "false"

    # --- Authentication ---
    # PWP__LOGIN_SESSION_TIMEOUT: "2 hours"
    # PWP__DISABLE_SIGNUPS: "false"
    # PWP__DISABLE_LOGINS: "false"
    # PWP__SIGNUP_EMAIL_REGEXP: ""
    # PWP__ENABLE_USER_ACCOUNT_EMAILS: "false"

    # --- Mail (required for logins / account emails) ---
    # PWP__MAIL__RAISE_DELIVERY_ERRORS: "false"
    # PWP__MAIL__SMTP_ADDRESS: ""
    # PWP__MAIL__SMTP_DOMAIN: ""
    # PWP__MAIL__SMTP_PORT: "587"
    # PWP__MAIL__SMTP_AUTHENTICATION: ""
    # PWP__MAIL__SMTP_USER_NAME: ""
    # PWP__MAIL__SMTP_PASSWORD: ""
    # PWP__MAIL__SMTP_ENABLE_STARTTLS_AUTO: "true"
    # PWP__MAIL__SMTP_OPEN_TIMEOUT: "10"
    # PWP__MAIL__SMTP_READ_TIMEOUT: "10"
    # PWP__MAIL__MAILER_SENDER: ""

    # --- Push: password (pw) ---
    # PWP__PW__EXPIRE_AFTER_DAYS_DEFAULT: "7"
    # PWP__PW__EXPIRE_AFTER_DAYS_MIN: "1"
    # PWP__PW__EXPIRE_AFTER_DAYS_MAX: "90"
    # PWP__PW__EXPIRE_AFTER_VIEWS_DEFAULT: "5"
    # PWP__PW__EXPIRE_AFTER_VIEWS_MIN: "1"
    # PWP__PW__EXPIRE_AFTER_VIEWS_MAX: "100"
    # PWP__PW__ENABLE_RETRIEVAL_STEP: "true"
    # PWP__PW__RETRIEVAL_STEP_DEFAULT: "false"
    # PWP__PW__ENABLE_DELETABLE_PUSHES: "true"
    # PWP__PW__DELETABLE_PUSHES_DEFAULT: "true"
    # PWP__PW__ENABLE_BLUR: "true"

    # --- Push: URL ---
    # PWP__URL__EXPIRE_AFTER_DAYS_DEFAULT: "7"
    # PWP__URL__EXPIRE_AFTER_VIEWS_DEFAULT: "5"
    # PWP__URL__ENABLE_RETRIEVAL_STEP: "true"
    # PWP__URL__RETRIEVAL_STEP_DEFAULT: "false"

    # --- Push: files ---
    PWP__FILES__STORAGE: "local" # See: https://docs.pwpush.com/docs/self-hosted-configuration/#file-storage-backends
    # PWP__FILES__EXPIRE_AFTER_DAYS_DEFAULT: "7"
    # PWP__FILES__EXPIRE_AFTER_VIEWS_DEFAULT: "5"
    # PWP__FILES__ENABLE_RETRIEVAL_STEP: "true"
    # PWP__FILES__RETRIEVAL_STEP_DEFAULT: "false"
    # PWP__FILES__ENABLE_DELETABLE_PUSHES: "true"
    # PWP__FILES__DELETABLE_PUSHES_DEFAULT: "true"
    # PWP__FILES__BLUR: "true"
    # PWP__FILES__MAX_FILE_UPLOADS: "10"
    # S3: PWP__FILES__S3__ENDPOINT, ACCESS_KEY_ID, SECRET_ACCESS_KEY, REGION, BUCKET
    # GCS: PWP__FILES__GCS__PROJECT, CREDENTIALS, BUCKET, IAM, GSA_EMAIL
    # Azure: PWP__FILES__AS__STORAGE_ACCOUNT_NAME, STORAGE_ACCESS_KEY, CONTAINER

    # --- Push: QR ---
    # PWP__QR__EXPIRE_AFTER_DAYS_DEFAULT: "7"
    # PWP__QR__EXPIRE_AFTER_VIEWS_DEFAULT: "5"
    # PWP__QR__ENABLE_RETRIEVAL_STEP: "true"
    # PWP__QR__RETRIEVAL_STEP_DEFAULT: "false"
    # PWP__QR__ENABLE_DELETABLE_PUSHES: "true"
    # PWP__QR__DELETABLE_PUSHES_DEFAULT: "true"

    # --- Password generator (gen) ---
    # PWP__GEN__HAS_NUMBERS: "true"
    # PWP__GEN__TITLE_CASED: "true"
    # PWP__GEN__USE_SEPARATORS: "true"
    # PWP__GEN__CONSONANTS: ""
    # PWP__GEN__VOWELS: ""
    # PWP__GEN__SEPARATORS: ""
    # PWP__GEN__MAX_SYLLABLE_LENGTH: "3"
    # PWP__GEN__MIN_SYLLABLE_LENGTH: "1"
    # PWP__GEN__SYLLABLES_COUNT: "3"

    # --- Branding & UI ---
    # PWP__BRAND__TITLE: ""
    # PWP__BRAND__TAGLINE: ""
    # PWP__BRAND__DISCLAIMER: ""
    # PWP__BRAND__SHOW_FOOTER_MENU: "true"
    # PWP__SHOW_VERSION: "true"
    # PWP__SHOW_GDPR_CONSENT_BANNER: "false"
    # PWP__THEME: "default" # See: https://docs.pwpush.com/docs/rebranding/#themes
    # PWP_PRECOMPILE: "false"  # Set "true" if using custom theme/assets!  May add 30-90 seconds to boot time.

    # --- Locale ---
    # PWP__TIMEZONE: "America/New_York"
    # PWP__DEFAULT_LOCALE: "en"

    # --- Security & infra ---
    # PWP__SECURE_COOKIES: "false"
    # PWP__THROTTLING__MINUTE: "120"
    # PWP__THROTTLING__SECOND: "60"
    # PWP__PURGE_AFTER: "disabled"

    # --- Logging ---
    # PWP__LOG_LEVEL: "warn"
    # PWP__LOG_TO_STDOUT: "true"

    # --- Docker / process ---
    # PWP__NO_WORKER: "true"   # Web only (no background worker)

services:
  pwpush:
    # "latest" is mostly reliable; use "stable" for well tested releases.
    image: docker.io/pglombardo/pwpush:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "5100:5100" # This can be removed if you set TLS_DOMAIN
    volumes:
      - pwpush-storage:/opt/PasswordPusher/storage
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5100/up"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    <<: *x-env
    # env_file: - .env

# Persists SQLite DB and file uploads. To use a host path instead, replace the
# pwpush-storage service volume with: - /path/on/host:/opt/PasswordPusher/storage
volumes:
  pwpush-storage:
    driver: local