---
title: "Ịwụnye Quire na Docker Compose"
description: "Wụnye Quire na akụrụngwa nke gị na Docker Compose."
image: "https://docs.quirelms.com/og.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.quirelms.com/ig/llms.txt
> Use this file to discover all available pages before exploring further.

# Ịwụnye Quire na Docker Compose

<span id="installing-quire-with-docker-compose"></span>

Nke a bụ ngwaahịa zuru oke n'otu họst: LMS, ọrụ ndabere ya,
ọrụ ozi ozugbo na idezi ọnụ, na ọrụ nhọrọ ọ bụla
n'azụ profaịlụ. Nhazi ahụ dị na `docs/architecture/23-ops.md` ngalaba 2.

Ebumnobi ndị ọzọ: [Vercel](/ig/ops/vercel/) na [Cloudflare Workers](/ig/ops/cloudflare/) na-agba
naanị ọkwa weebụ. Mmelite dị na [upgrade.md](/ig/ops/upgrade/), na ndabere na
mmega iweghachi na [backup-restore.md](/ig/ops/backup-restore/).

## Ihe ị chọrọ <!--quire:what-you-need-->

- Docker Engine 27 ma ọ bụ nke ọhụrụ na Compose plugin 2.30 ma ọ bụ nke ọhụrụ.
- 4 CPU cores na 8 GB ebe nchekwa maka stack ndabara; 8 cores na 16 GB
  na `--profile full` (naanị ClamAV na-ejide ihe dịka 1.5 GB nke mbinye aka).
- Aha DNS maka ọkwa weebụ na nke abụọ maka ọdịnaya anaghị atụkwasị obi. Ha
  ga-abụrịrị họst dị iche: ngwugwu SCORM na HTML ebugoro na-agba na origin
  ọdịnaya ka ha ghara ịgụ kuki LMS.
- Maka nnwale mpaghara, `lvh.me` na `*.localhost` na-atụ aka na 127.0.0.1, nke
  bụ ihe `docker/.env.example` na-eji. Ọrụ `proxy` nke stack na-enye
  ha abụọ site na https na certificate authority mpaghara, ya mere ọ dịghị ihe ọzọ
  a na-awụnye (lee "TLS").
- Ports 80 na 443 nweere onwe na họst (`QUIRE_PROXY_HTTP_PORT` na
  `QUIRE_PROXY_HTTPS_PORT` na-ebugharị ha).

## Mbido mbụ <!--quire:first-run-->

```sh
QUIRE_APP_ORIGIN=https://learn.example.org \
QUIRE_CONTENT_ORIGIN=https://content.example-content.org \
QUIRE_SETUP_ADMIN_EMAIL=you@example.org \
  docker/scripts/init-env.sh
docker compose -f docker/compose.yaml up -d --build
docker compose -f docker/compose.yaml logs init
```

`docker/scripts/init-env.sh` na-ede `docker/.env` site na `docker/.env.example`
na nzuzo ọ bụla emepụtara (okwuntughe nchekwa data, igodo mbinye aka na igodo ukwu,
ụzọ igodo mmalite ọdịnaya) na igodo mbinye aka checkpoint nyocha na
`docker/secrets/audit-signing-key.pem`, nke Compose na-agbanye na workers
dịka nzuzo. Ọ chọrọ naanị `sh`, `awk` na `openssl`, ọ na-ajụ
idegharị `docker/.env` dị adị. Detuo faịlụ abụọ ahụ pụọ na họst: na-enweghị
`QUIRE_MASTER_KEY` nchekwa data eweghachiri enweghị ike iwepu nzuzo na nzere echekwara ya.
Iji mejupụta faịlụ n'aka kama, `cp docker/.env.example docker/.env`; nke
faịlụ na-ekwu otu esi emepụta nzuzo ọ bụla.

Origin abụọ ahụ ga-abụrịrị `https`: ọrụ ọdịnaya na-ajụ http nkịtị na
mmepụta, ha agaghị ekerịta domain edebanyere. Ọrụ `proxy`
na-akwụsị TLS maka ha abụọ (lee "TLS"); `init-env.sh` na-ajụ
origin `http://`.

Stack na-amalite n'usoro edoziri, nzọụkwụ ọ bụla na-echere nke bu ya ụzọ:

1. `postgres` aghọọ ahụike. Na mmalite mbụ script init ya
   (`docker/postgres/init/90-passwords.sh`) na-atọ okwuntughe ọrụ anọ.
2. `migrate` na-etinye mbugharị ọ bụla ma na-ebupụta queue ọrụ na
   nchekwa data njikwa na na nchekwa data tenant raara onwe ya ọ bụla, na-enyocha na ha
   niile kwenyere, emesịa pụọ (docs/ops/upgrade.md).
   Mbugharị na-agba na mmalite ọ bụla ma bụ idempotent, ya mere mmelite bụ image
   ọhụrụ na ịmalitegharị.
3. `init` (`apps/web/src/first-run.ts`) na-edekọ nchekwa data ngwa n'okpuru
   `QUIRE_DATABASE_ID` na, mgbe `QUIRE_SETUP_ADMIN_EMAIL` atọrọ, na-emepụta
   otu mbụ na onye nchịkwa ya. A na-ebipụta adreesị nbanye na
   okwuntughe emepụtara otu ugboro, na `docker compose logs init`.
4. `web`, `content`, `worker`, `scheduler`, `collab` na `centrifugo` na-amalite.
5. `proxy` na-amalite ozugbo `web` na `content` dị ahụike.

Mepee `https://demo.` na-esote domain ngwa gị (log `init`
na-ebipụta adreesị nbanye kpọmkwem), wee banye. Na nrụnye mpaghara, tụkwasị
certificate authority nke proxy obi nke mbụ (lee "TLS"). Gbanwee okwuntughe emepụtara na `/account/security`.

Usoro amalitere na-enweghị nzuzo achọrọ na-ajụ ịmalite ma kpọọ
ntọala na-efu na log ya. Ọ dịghị ihe na-amalite ọkara ahaziri.

## Ọrụ na profaịlụ <!--quire:services-and-profiles-->

| Ọrụ | Profaịlụ | Ihe ọ na-eme |
| --- | --- | --- |
| postgres | always | Nchekwa data (PostgreSQL 18 na pgvector, e wuru site na `docker/postgres.Dockerfile`), na WAL echekwara site na mbido mbụ |
| migrate, init | always | Otu ogbugba: mbugharị, emesịa mbido mbụ |
| web | always | LMS, na `QUIRE_HTTP_PORT` (8080) |
| content | always | Origin ọdịnaya anaghị atụkwasị obi, na `QUIRE_CONTENT_PORT` (8081) |
| worker | always | Ọrụ ndabere: email, akụkọ, nhazi faịlụ, webhooks |
| scheduler | always | Ọrụ na-eme ugboro ugboro: na-edebanye nhazi runtime 64 ma nyefee ha na worker; otu onye ndu n'otu oge |
| collab | always | Websocket idezi ọnụ, na `QUIRE_COLLAB_HTTP_PORT` (1234) |
| centrifugo | always | Mgbasa ozi ozugbo, na `QUIRE_REALTIME_PORT` (8000) |
| proxy | always | Caddy, ọnụ ụzọ TLS na ports 80 na 443 (lee "TLS") |
| valkey | `cache` | Cache na oke ọnụego |
| clamav | `scan` | Nyocha malware nke nbugo |
| gotenberg | `preview` | Nlele Office gaa PDF, nsụgharị asambodo |
| imgproxy | `images` | Onyonyo agbanweela nha na ụdị |
| transcoder | `video` | Image worker na ffmpeg naanị LGPL, maka nsụgharị vidiyo |
| seaweedfs | `storage` | Nchekwa ihe dabara S3 na họst a |
| otelcol | `observability` | Onye nchịkọta OpenTelemetry |
| mailpit | `devmail` | Na-ejide mail na-apụ apụ niile, maka ịnwale Quire |
| backup | `backup` | Mbipụta ndabere mbụ otu ogbugba; lee backup-restore.md |
| backup-scheduler, backup-offsite | `backup` | Mbipụta ndabere mbụ kwa `QUIRE_BACKUP_INTERVAL_HOURS`, na mbipụta nzuzo n'èzí họst na mmega nkwenye kwa izu |
| h5p | `h5p` | Image ngwaọrụ H5P LTI 1.3 ị na-enye na `QUIRE_H5P_IMAGE`, na `QUIRE_H5P_PORT` (8090); lee "Connecting an H5P provider" |

`--profile full` na-amalite ọrụ nhọrọ ọ bụla ma e wezụga `backup` na `h5p`.
Malite otu na `docker compose -f docker/compose.yaml --profile scan up -d`.
Na-enweghị ọrụ nhọrọ Quire ka na-arụ ọrụ ma kwuo ihe na-efu: enweghị
nyocha pụtara a na-echekwa nbugo na-enyochaghị ya a gwara onye nchịkwa; enweghị
Gotenberg pụtara faịlụ na-enye nbudata kama nlele; enweghị transcoder pụtara
vidiyo na-akpọ dịka faịlụ mbụ.

Image ndị ọzọ ọ bụla na ọrụ ikike ya dị na
`docker/third-party-containers.yaml`.

### Ijikọ onye na-enye H5P <!--quire:connecting-an-h5p-provider-->

Quire anaghị etinye ma ọ bụ buga runtime H5P ma ọ bụ sidecar (ADR 0019). Ọ bụrụ na ị na-eji
H5P, nye ndenye aha hosted nke gị ma ọ bụ rụọ H5P nke onwe gị
iche site na Quire. Debanye onye na-enye ahụ dịka ngwaọrụ mpụga LTI 1.3
ma tinye ọdịnaya ya na nkuzi dịka ihe omume ngwaọrụ. Quire na-agbanwe akara
na ọganihu ihe omume/akara site na LTI Assignment and Grade Services (AGS).
Ọ bụrụ na onye na-enye eziga nkwupụta xAPI, hazie nke ahụ iche maka
ụlọ ahịa nkwupụta xAPI nke Quire; mgbanwe akara/ọganihu AGS anaghị eziga nkwupụta xAPI.
Mbubata Moodle na-akọ ihe omume H5P dịka chọrọ njikọ ngwaọrụ LTI.
Onye na-enye na-anọgide na-ahụ maka runtime H5P ya, ide, ụlọ akụ ọdịnaya
na akụkọ mgbalị.

Iji gbaa nke onwe gị na họst a, tọọ `QUIRE_H5P_IMAGE` na image ya
ma malite profaịlụ `h5p`. Compose na-ebipụta ya na `QUIRE_H5P_PORT`
(8090) ma debe data ya na volum `h5p-data`; image, na
ọrụ ndị na-abịa na ya, na-anọgide nke gị.

## Ntọala <!--quire:settings-->

Usoro ọ bụla na-agụ `docker/.env`. Template, `docker/.env.example`, na-edepụta
ntọala ọ bụla na ndabara ya. Otu:

### Adreesị <!--quire:addresses-->

| Ntọala | Ihe ọ pụtara |
| --- | --- |
| `QUIRE_APP_ORIGIN` | Adreesị ọha LMS, dịka `https://learn.example.com` |
| `QUIRE_CONTENT_ORIGIN` | Origin ọdịnaya, họst dị iche |
| `QUIRE_PLATFORM_DOMAINS` | Domain otu bi n'okpuru, kewara na rikoma |
| `QUIRE_MARKETING_ORIGIN` | Optional. The marketing site, default `https://quirelms.com`. The only origin the waitlist form (`POST /api/waitlist`, `POST /waitlist`) accepts and redirects to. Comma separated; a `www.` variant is allowed only if listed |
| `QUIRE_DEPLOY_TARGET` | `compose` ebe a. Lee ntuziaka ndị ọzọ maka `vercel` na `cloudflare` |
| `QUIRE_TRUSTED_PROXY_CIDRS` | Proxy nke ekwere `X-Forwarded-For` ya |

### Nzuzo <!--quire:secrets-->

| Ntọala | Ihe ọ pụtara |
| --- | --- |
| `QUIRE_SECRET_KEY` | Na-ebinye aka na sessions na token. Mkpụrụedemede hex 64 |
| `QUIRE_MASTER_KEY` | Na-ekekọta nzere echekwara dịka nzuzo SSO na webhook. 32 bytes, base64. Ọkwa weebụ na worker chọrọ otu ụkpụrụ. Ntụgharị: [key-rotation.md](/ig/ops/key-rotation/) |
| `QUIRE_MASTER_KEY_VERSION` | Akara ụdị igodo ukwu, `v1` mgbe edobeghị. Bulie ya mgbe ị tụgharịrị |
| `QUIRE_MASTER_KEY_RETIRED` | Igodo ukwu ndị mbụ ka achọrọ ịgụ ihe ha mechiri, dịka `v1=<base64>`. Wepụ mgbe ntụgharị gwụsịrị na-enweghị ihe a na-edozibeghị |
| `QUIRE_COLLAB_SIGNING_KEY` | Web na collab na-ekerịta ibinye aka na token idezi |
| `QUIRE_BACKUP_SIGNING_KEY` | Na-ebinye aka na ndabere nkuzi (nhọrọ) |

Debe otu `QUIRE_MASTER_KEY` n'ebe ọzọ na-abụghị họst a. Nchekwa data
eweghachiri na-enweghị ya enweghị ike iwepu nzuzo na nzere o ji.

### Nchekwa data <!--quire:database-->

| Ntọala | Ihe ọ pụtara |
| --- | --- |
| `POSTGRES_PASSWORD` | Superuser, akpa na ndabere na-eji |
| `QUIRE_DB_APP_PASSWORD`, `QUIRE_DB_MIGRATOR_PASSWORD`, `QUIRE_DB_REPORT_PASSWORD`, `QUIRE_DB_AUDIT_PASSWORD` | Okwuntughe ọrụ, atọrọ na mmalite mbụ |
| `DATABASE_URL` | Ọrụ ngwa. Nchebe ọkwa ahịrị na-etinye na ajụjụ ọ bụla o mere |
| `DATABASE_MIGRATOR_URL`, `QUIRE_MIGRATION_URL` | Ọrụ migrator, maka `migrate` na `init` |
| `QUIRE_SUPERUSER_URL` | A na-eji naanị na mbido mbụ |
| `QUIRE_REPORT_DATABASE_URL` | Ọrụ akụkọ naanị ọgụgụ, maka akụkọ na onye wuo akụkọ |
| `QUIRE_AUDIT_DATABASE_URL` | Ọrụ nyocha, maka console nyocha na mbupụ SIEM |
| `QUIRE_DATABASE_ID` | UUID ọ bụla, edoziri maka ndụ nrụnye |

A na-etinye okwuntughe ọrụ naanị mgbe emepụtara volum nchekwa data nke mbụ.
Iji gbanwee otu emesịa, jiri `ALTER ROLE` emesịa melite URL dakọtara.

A na-eji `QUIRE_REPORT_DATABASE_URL` maka nchekwa data anụ ahụ `DATABASE_URL`
kpọrọ. Maka nchekwa data anụ ahụ ọ bụla ọzọ edebanyere, tọọ URL njikọ
`quire_report` nke ya na gburugburu weebụ na worker, emesịa tinye
aha mgbanwe na mpaghara **Reporting environment variable** nke nchekwa data ahụ
dịka `env:NAME`. Nrụtụ aka ga-atụ aka na otu nchekwa data dịka njikọ ngwa ya,
ọ kacha mma nnomi ọgụgụ ya. Elu akụkọ ọ bụla na-eso
tenant na njikọ akụkọ nchekwa data nke ya: onye wuo akụkọ na
akụkọ echekwara, nnyefe ahaziri, mbupụ akụkọ, analytics, log
nyocha, akụrụngwa nyocha REST na ọchụchọ nyocha onye enyemaka. Ọ dịghị nke
ha na-agbaziri URL akụkọ nchekwa data ọzọ. Mgbe nchekwa data enweghị
njikọ akụkọ, akụkọ nkịtị na-agba na njikọ ngwa nke nchekwa data ahụ n'onwe ya,
ebe analytics na ọgụgụ nyocha ọ bụla na-ajụ ma kwuo ya, n'ihi na
ọrụ ngwa enweghị ike ịgụ ụzọ nyocha.

### Drivers <!--quire:drivers-->

| Ntọala | Mwepụta a | Ndetu |
| --- | --- | --- |
| `QUIRE_STORAGE_DRIVER` | `local` (ndabara), `s3` ma ọ bụ `azure` | `local` na-edebe faịlụ na volum `files`. `s3` na-ekpuchi AWS S3, R2, mmekọrịta GCS na ụlọ ahịa ndị ọzọ dabara S3, na nbugo multipart nwere ike ịga n'ihu |
| `QUIRE_REALTIME_DRIVER` | `inprocess` (ndabara), `sse`, `centrifugo` ma ọ bụ `durable_objects` | `inprocess` dị mma maka otu akpa weebụ; jiri `centrifugo` ma ọ bụ `sse` mgbe ha dị ọtụtụ |
| `QUIRE_CACHE_DRIVER` | `memory` (ndabara), `postgres` ma ọ bụ `valkey` | `memory` bụ kwa usoro; jiri `valkey` ma ọ bụ `postgres` ka oke ọnụego jide gafee akpa |
| `QUIRE_VIDEO_DRIVER` | `ffmpeg` (ndabara) ma ọ bụ `progressive_mp4` | Ma ọ bụ onye na-enye hosted: Cloudflare Stream, Mux ma ọ bụ Bunny, site na igodo ha |
| `QUIRE_IMAGE_DRIVER` | `noop` (ndabara), `imgproxy` ma ọ bụ `cloudflare` | `noop` na-enye onyonyo ọ bụla na nha mbụ ya. `imgproxy` chọrọ profaịlụ `images` na ntọala dị n'okpuru; `cloudflare` na-eji Cloudflare Images |
| `QUIRE_MEETING_PROVIDER` | `bbb`, `zoom`, `teams`, `meet`, `jitsi` ma ọ bụ `in_process` | Ndabara platform maka nnọkọ ndụ. Edobeghị, nnọkọ ndụ na-ekwu na ahazighị ha, ruo mgbe otu jikọtara akaụntụ nke ya n'okpuru Integrations, Live session provider. Akaụntụ nke otu na-emeri uru a mgbe niile. Ntọala nke onye na-enye ọ bụla (`BBB_URL` na `BBB_SECRET`, mgbanwe `ZOOM_*`, `TEAMS_*`, `GOOGLE_MEET_*` na `JITSI_*`) a na-agụ naanị maka onye na-enye akpọrọ ebe a |
| `QUIRE_MEETING_REGIONS` | Ndepụta rikoma nke `eu`, `uk`, `us` | Ebe onye na-enye ndabara platform na-ahazi nzukọ. Edobeghị, anaghị enyocha ya megide otu a tụkwasịrị na mpaghara, dịka mbụ. Akaụntụ nke otu na-ekwu mpaghara ya na ibe ya |

Uru driver nke mwepụta a enweghị a na-ajụ mgbe ọkwa weebụ
malitere, na-akpọ ntọala, kama iji nwayọ dochie ya na
ndabara.

### Onyonyo <!--quire:images-->

Peeji na-arịọ onyonyo na nha anọ edoziri site na
`/api/files/{id}/image/{size}`, nke na-enyocha otu nnweta dịka faịlụ
n'onwe ya emesịa tụgharịa na ọrụ onyonyo. Otu ọ bụla nwere ike ịrịọ
ụzọ onyonyo na nha ọhụrụ `QUIRE_IMAGE_SPECS_PER_HOUR` (ndabara 2000) n'otu
elekere; nha emepụtarala n'elekere ahụ agụghị. Jiri `valkey` ma ọ bụ
`postgres` maka `QUIRE_CACHE_DRIVER` na ihe karịrị otu akpa weebụ, ka
oke jide gafee ha.

| Ntọala | Driver | Ndetu |
| --- | --- | --- |
| `IMGPROXY_URL` | `imgproxy` | Adreesị ihe nchọgharị ji eru imgproxy, dịka `https://images.example.org`. Profaịlụ `images` na-ebipụta ya na `QUIRE_IMAGES_PORT` (8082) |
| `IMGPROXY_KEY`, `IMGPROXY_SALT` | `imgproxy` | Eriri hex, otu ụkpụrụ imgproxy ji malite. Mepụta nke ọ bụla na `openssl rand -hex 32`. Quire na-ebinye aka na adreesị onyonyo ọ bụla na ha, ya mere imgproxy anaghị sụgharịa ihe Quire na-arịọghị |
| `QUIRE_IMAGE_SOURCE_ORIGIN` | `imgproxy` na nchekwa mpaghara | Ebe imgproxy na-eweta mbụ. Compose na-atọ `http://web:3000`. Na nchekwa `s3` ma ọ bụ `azure` imgproxy na-eweta site na bucket nke a anaghị eji |
| `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_IMAGES_TOKEN`, `CLOUDFLARE_IMAGES_ACCOUNT_HASH` | `cloudflare` | Token API na ikike ide Images, na hash akaụntụ site na Images, Developer resources. Gbanye variants na-agbanwe maka akaụntụ |
| `CLOUDFLARE_IMAGES_SIGNING_KEY` | `cloudflare` | Nhọrọ. Mgbe atọrọ, onyonyo bụ nke nzuzo adreesị ọ bụla ebinye aka wee gwụ. Na-enweghị ya, onyonyo bụ ọha na adreesị enwetara site na `QUIRE_SECRET_KEY` nke ọ dịghị onye nwere ike ịkọ |

Cloudflare Images na-edebe otu nke ya nke mbụ ọ bụla o nyere. Mgbe
ehichapụrụ faịlụ, worker na-ehichapụ mbipụta ahụ tupu mbụ.

### Queue <!--quire:queue-->

Ọrụ ndabere na-eji pg-boss n'otu nchekwa data Postgres, ya mere enweghị
ọrụ queue ịgba na ọ dịghị ihe ịhazi. A na-etinye ọrụ n'ahịrị n'otu
transaction dịka mgbanwe kpatara ha, ya mere crash enweghị ike tufuo otu ma ọ bụ
zipu otu ugboro abụọ. `QUIRE_QUEUE_DRIVER` bụ `pgboss` ebe a, ndabara ya; `vercel`
na `cloudflare` na-ebugharị naanị nnyefe ngosi na webhook dị mfe na
queue nke platform n'onwe ya, ntuziaka Vercel na Cloudflare na-akọwa ha
na otu ọkwa weebụ ha si etinye n'ahịrị.

### Email <!--quire:email-->

Tọọ otu n'ime:

- `QUIRE_EMAIL_PROVIDER_CONFIG`: ihe JSON na-akpọ onye na-enye HTTP na
  nzere ya, dịka `{"provider":"postmark","token":"..."}`. Postmark,
  Amazon SES, Mailgun, SendGrid na Resend ka akwadoro.
- `QUIRE_SMTP_URL`: `smtp://user:password@host:587`. Nke a ebumnobi naanị; nke
  ebumnobi serverless na-egbochi SMTP.

`QUIRE_MAIL_FROM` bụ onye zitere. Maka ịnwale Quire, malite profaịlụ `devmail`,
tọọ `QUIRE_SMTP_URL=smtp://mailpit:1025`, ma gụọ mail na
`http://localhost:8025`.

### Ọrụ nhọrọ <!--quire:optional-services-->

| Ntọala | Na profaịlụ |
| --- | --- |
| `CLAMAV_URL=tcp://clamav:3310` | `scan` |
| `GOTENBERG_URL=http://gotenberg:3000` | `preview` |
| `IMGPROXY_KEY`, `IMGPROXY_SALT` | `images` |
| `VALKEY_URL=redis://valkey:6379` | `cache` |
| `QUIRE_OPENSEARCH_URL` ma ọ bụ `QUIRE_MEILISEARCH_URL` | Ọchụchọ mpụga; ederede zuru Postgres ma ọ bụghị |
| `QUIRE_BREACH_CHECK_PROVIDER=off`, `QUIRE_BREACH_CHECK_URL` | Nyocha mmebi okwuntughe. Gbanye na ndabara megide `api.pwnedpasswords.com` (naanị prefix hash mkpụrụedemede ise ka ezigara); `off` na-agbanyụ ya, URL na-atụ aka na range API ị na-elekọta |

### Nleba anya <!--quire:observability-->

`OTEL_EXPORTER_OTLP_ENDPOINT` na-akpọ onye nchịkọta usoro ọ bụla na-ezigara
traces na metrics; na profaịlụ `observability` ọ bụ
`http://otelcol:4318`, `docker/otel-collector.yaml` bụ ebe ị na-etinye
exporter maka backend gị. Ọkwa weebụ, worker, scheduler, content na collab
usoro na-ebupụ spans site na OTLP/HTTP (arịrịọ weebụ, transaction nchekwa data
tenant, ọrụ worker na oku na-apụ) mgbe atọrọ ya, na metrics na
otu endpoint kwa nkeji (`OTEL_METRICS_EXPORTER=none` na-agbanyụ ha).
`OTEL_TRACES_SAMPLER_ARG` na-atọ oke traces echekwara. Logs na-aga na standard
output na `LOG_LEVEL`, Compose na-atụgharị ha. Traces anaghị ebu data
onwe.

### Ọpụpụ mpaghara (EU data residency) <!--quire:regional-egress-eu-data-residency-->

`QUIRE_REGION=eu` na-ekwu na stack na-enye otu European Union. Nke
worker na-ejide arịrịọ na-apụ ọ bụla emere maka otu a tụkwasịrị na
EU na allowlist (21-compliance.md ngalaba 8.1). Allowlist bụ
họst nke ọrụ ahaziri na-ekwupụta maka mpaghara (endpoint
nchekwa, onye na-enye email, onye na-enye vidiyo hosted, ebumnobi nchekwa nke
otu, ndị na-enye AI na akaụntụ email), họst nke ọrụ ọ bụla
n'okpuru derogation na-arụ ọrụ, na họst ị depụtara na
`QUIRE_EGRESS_ALLOW_HOSTS`. A na-ajụ arịrịọ na họst ọha ọ bụla ọzọ
tupu eziga ya, a na-ede ọjụjụ na ụzọ nyocha otu dịka
`privacy/egress_refused`, a na-edepụta ya n'okpuru Compliance, Data residency.

| Ntọala | Ụkpụrụ | Mmetụta |
| --- | --- | --- |
| `QUIRE_EGRESS_ALLOW_HOSTS` | Ndepụta rikoma nke hostnames, ma ọ bụ `*.example.org` maka subdomain ọ bụla | Họst ndị ọzọ otu EU nwere ike iru. Webhook, xAPI na SIEM endpoints, blog feeds na họst Amazon SES dị ebe a, n'ihi na ha bụ nhọrọ nke otu n'onwe ya ọrụ ọ dịghị ekwupụta ha. Loopback, adreesị nzuzo na aha otu label dịka `web` ma ọ bụ `clamav` bụ netwọk nke gị anaghị enyocha mgbe ọ bụla |

Otu UK na US anaghị ejide na ndepụta họst; ha na-edobe nlele mpaghara ọrụ.
Tọọ ndepụta na worker; ibe admin na-agụ ya na weebụ
ọkwa igosi allowlist, ya mere tinye ya na `docker/.env`, nke ọrụ ọ bụla
na-agụ.

Nlele ngwa na-enye njehie doro anya na ndenye nyocha, ọ abụghịkwa
nkwa: koodu nwere ike ịdị njọ. Nkwa bụ netwọk. Compose anaghị
mmanye ya maka gị. Maka stack mpaghara, tinye ọrụ `worker` na `web`
na netwọk `internal: true` nke naanị ụzọ ọpụpụ ya bụ proxy ọpụpụ
(dịka ọmụmaatụ Squid ma ọ bụ akpa tinyproxy) nke na-ekwe otu họst
dịka `QUIRE_EGRESS_ALLOW_HOSTS` gbakwunyere họst nke ọrụ ahaziri gị, ma
tọọ `HTTPS_PROXY` maka ọrụ ndị ahụ. Ibe residency na-edepụta kpọmkwem
họst ngwa na-ekwe, ya mere enwere ike ịtụnyere ndepụta abụọ ahụ.

## Ahụike <!--quire:health-->

| Endpoint | Ihe ọ pụtara |
| --- | --- |
| `/healthz` | Ndụ: usoro na-aza. Nlele ahụike Compose na-eji nke a |
| `/readyz` | Njikere: ndabere enwere ike iru, a na-akọ ọrụ nhọrọ ọ bụla dịka ahaziri ma ọ bụ na ọ bụghị. Tụọ load balancer gị ebe a |

`docker compose -f docker/compose.yaml ps` na-egosi ahụike ọrụ ọ bụla.

## TLS <!--quire:tls-->

Ọrụ `proxy` (Caddy, Apache-2.0, `docker/caddy/Caddyfile`) bụ akụkụ nke
stack ndabara. Ọ na-aza na ports 80 na 443 ma na-ebugharị:

| Họst ma ọ bụ ụzọ | Na-aga na |
| --- | --- |
| `QUIRE_PROXY_CONTENT_HOST` | `content` |
| `QUIRE_PROXY_APP_HOST`, subdomain tenant ọ bụla na domain omenala | `web` |
| `/_collab/` na họst ndị ahụ | `collab` (websocket, `QUIRE_COLLAB_URL`) |
| `/_realtime/connection/` na họst ndị ahụ | Websocket onye ahịa `centrifugo`; API sava ya anaghị ekpughe mgbe ọ bụla |
| `/_images/` na họst ndị ahụ | `imgproxy`, na profaịlụ `images` (`IMGPROXY_URL`) |

`init-env.sh` na-enweta `QUIRE_PROXY_APP_HOST`, `QUIRE_PROXY_CONTENT_HOST`,
`QUIRE_PROXY_HTTPS_PORT`, `QUIRE_COLLAB_URL` na `IMGPROXY_URL` site na abụọ
origins, ya mere ha enweghị ike ịgbasa. Dezie ha ọnụ ọ bụrụ na ị gbanwee
origin n'aka.

Asambodo na-eso `QUIRE_PROXY_TLS`:

- `internal` (ndabara): certificate authority nke Caddy n'onwe ya, maka
  `localhost`, `*.localhost` na `lvh.me`. Tụkwasị mgbọrọgwụ ya obi otu ugboro, emesịa chọgharị:

  ```sh
  docker compose -f docker/compose.yaml cp \
    proxy:/data/caddy/pki/authorities/local/root.crt ./quire-local-ca.crt
  ```

  Tinye `quire-local-ca.crt` na ụlọ ahịa ntụkwasị obi sistemụ ma ọ bụ ihe nchọgharị. `curl`
  na-ewere ya na `--cacert`.
- Adreesị email: asambodo ACME akpaka (Let's Encrypt, emesịa
  ZeroSSL) maka hostnames ezigbo. DNS maka origins abụọ na họst tenant ọ bụla
  ga-atụ aka ebe a, ports 80 na 443 ga-enwerịrị ike iru site na ịntanetị.

A na-enye họst tenant mgbe achọrọ, na nleta mbụ, naanị mgbe web
gosipụtara na aha bụ nke nrụnye a (`/tls-allowed`, ajụrụ na
netwọk Compose). Ọ dịghị mkpa asambodo wildcard ma ọ bụ plugin onye na-enye DNS,
onye ọbịbịa na-atụ aka aha na họst enweghị ike ime ka ọ rịọ
asambodo. Asambodo na authority mpaghara bi na
volum `caddy-data`; debe ndabere ya na ndị ọzọ ọ bụrụ na ị na-eji `internal`.

Web kwere `X-Forwarded-For` site na proxy naanị: proxy nwere adreesị edoziri
(`QUIRE_PROXY_ADDRESS`, ndabara `172.29.64.10`) na subnet edoziri
(`QUIRE_COMPOSE_SUBNET`), `QUIRE_TRUSTED_PROXY_CIDRS` na-akpọ adreesị ahụ.
Ọ bụrụ na subnet na-adakọ na netwọk na họst, gbanwee ha abụọ wee gbaa
`docker compose down` tupu `up`.

## N'azụ reverse proxy nke gị <!--quire:behind-your-own-reverse-proxy-->

Iji jiri load balancer ma ọ bụ proxy ị na-agba kama, hapụ `proxy` pụọ
(`docker compose up -d --scale proxy=0`) ma kwụsị TLS n'ihu `web`
(8080), `content` (8081), `collab` (1234, websocket) na `centrifugo` (8000,
websocket). Tọọ adreesị ọha na `QUIRE_APP_ORIGIN`,
`QUIRE_CONTENT_ORIGIN` na `QUIRE_COLLAB_URL` (`wss://`), na oke adreesị
proxy gị na `QUIRE_TRUSTED_PROXY_CIDRS`.

## Nchọpụta nsogbu <!--quire:troubleshooting-->

- `init` na-apụ na "QUIRE_DATABASE_ID is not a UUID": tọọ ya na `uuidgen`.
- `web` na-amalitegharị na "did not start on compose": log na-edepụta ntọala ọ bụla
  ọ na-enweghị ike ịsọpụrụ na ihe iji kama.
- Ịgbanwe okwuntughe ọrụ na `.env` mgbe mmalite mbụ emeghị ihe ọ bụla: nke
  script init na-agba otu ugboro. Jiri `ALTER ROLE`.
- Nbugo na-ada na njehie nyocha ebe `CLAMAV_URL` atọrọ: ClamAV na-ebudata
  mbinye aka ya na mmalite mbụ, nke na-ewe nkeji ole na ole.

Source: https://docs.quirelms.com/ig/ops/install/index.mdx