docker-compose.yml

# Run the pagecast admin dashboard + local page server in a container.
#
#   docker compose up --build      # then open http://localhost:4173
#
# Publishing to Cloudflare from inside the container uses an API token: the
# dashboard's interactive "Connect Cloudflare" OAuth flow needs a browser the
# container does not have. Copy .env.example to .env and fill in the token to
# enable publishing / deploys.
services:
  pagecast:
    build: .
    image: pagecast:local
    # Persist config + published history across container restarts.
    volumes:
      - ./.pagecast:/app/.pagecast
    # Map ONLY to the host loopback: browser CSRF and private local capabilities
    # protect admin mutations, but Pagecast is not a remote multi-user service
    # and can run shell commands. Never publish it on a routable interface.
    ports:
      - "127.0.0.1:4173:4173"  # admin dashboard
      - "127.0.0.1:4174:4174"  # local published-page server
    environment:
      HOST: "0.0.0.0"
      # Explicitly allow the container's wildcard bind. Keep the published
      # admin port restricted to host loopback above.
      PAGECAST_ALLOW_LOOPBACK_PROXY: "1"
      # Optional — enables Cloudflare publishing from the container (see .env).
      CLOUDFLARE_API_TOKEN: "${CLOUDFLARE_API_TOKEN:-}"
      CLOUDFLARE_ACCOUNT_ID: "${CLOUDFLARE_ACCOUNT_ID:-}"
    # `serve` is the image default; stated here for clarity.
    command: ["serve"]