---
title: "Te whakaturanga i te Quire ma te Docker Compose"
description: "Whakaturia a Quire i tō ake wāhanga whakarite me te Docker Compose."
image: "https://docs.quirelms.com/og.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.quirelms.com/mi/llms.txt
> Use this file to discover all available pages before exploring further.

# Te whakaturanga i te Quire ma te Docker Compose

<span id="installing-quire-with-docker-compose"></span>

Ko tēnei te produk katoa i tētahi pūrere kotahi: te LMS, ā rātou mahi i muri,
ngā ratonga whakatika tūturu me te mahi ngātahi, me ia ratonga kōwhiria kei raro
i tētahi profile. Ko te hoahoa te `docs/architecture/23-ops.md` wāhanga 2.

Ētahi atu wāhi whakaturanga: ke [Vercel](/mi/ops/vercel/) me ngā [Cloudflare
Workers](/mi/ops/cloudflare/) e mahi ana ki te wāhanga ipurangi anake. Kei
[upgrade.md](/mi/ops/upgrade/) ngā whakahou, ā, kei [backup-restore.md](/mi/ops/backup-restore/)
ngā pupuniBackup me te whakamātau whakahoki.

## He aha e hiahiatia ana <!--quire:what-you-need-->

- Docker Engine 27 rānei i muri mai, me te pūtukunga Compose 2.30 rānei i muri
  mai.
- 4 ngā pū CPU me te 8 GB memoe mō te kōpae tūtohu; 8 pū me te 16 GB me te
  `--profile full` (ko te ClamAV anake ka pupuri i te 1.5 GB tata ngā tohu).
- He ingoa DNS mō te wāhanga ipurangi me tētahi atu mō te ihirangi kāore e
  whakawhirinaki. Me rerekē ō rātou wāhi whakaturanga: ka tū ngā kete SCORM me
  ngā HTML kua tuku i te pū o te ihirangi, kia kore rātou e pānui i ngā cookie o
  te LMS.
- Mō te whakamātau ā-rohe, e tū ana te `lvh.me` me te `*.localhost` ki te
  127.0.0.1, ko ia te mea e whakamahia ana e te `docker/.env.example`. Ka tuku te
  ratonga `proxy` ōna ake i ērua ma te https me tētahi mana tiwhikete ā-rohe, nō
  reira kāore tētahi atu e whakaturia (tirohia "TLS").
- Ngā poro 80 me 443 wātea i te pūrere (`QUIRE_PROXY_HTTP_PORT` me te
  `QUIRE_PROXY_HTTPS_PORT` e neke ana i a rātou).

## Te tīmata tuatahi <!--quire:first-run-->

```sh
QUIRE_APP_ORIGIN=https://learn.example.org \
QUIRE_CONTENT_ORIGIN=https://content.example-content.org \
QUIRE_SETUP_ADMIN_EMAIL=you@example.org \
  docker/scripts/init-env.sh
docker compose -f docker/compose.yaml up -d --build
docker compose -f docker/compose.yaml logs init
```

`docker/scripts/init-env.sh` ka tuhi `docker/.env` mai i te `docker/.env.example`
me ia kupu tūmataiti e hangaia ana (ngā kupuhipa pūtaka, ngā kī tā me ngā kī
matua, te kōpui kī whakataka ihirangi) me te kī tā tuhipoka arotake i te
`docker/secrets/audit-signing-key.pem`, e whakauru ana te Compose ki ngā kai mahi
hei kupu tūmataiti. He hiahiatia anake i a ia te `sh`, te `awk` me te `openssl`,
ā, ka ārai ia te whakakapi i tētahi `docker/.env` kua tū kē. Tāruatia ērua kōnae i
waho o te pūrere: me te kore te `QUIRE_MASTER_KEY`, kāore e taea e tētahi pūtaka
kua whakahoki te wehenga i ōna tohu whakamanatanga kua kohia. Mēnā ka whai te
tuhinga i te ringa i tōna wā, `cp docker/.env.example docker/.env`; ka kōrerotia
e te kōnae te āhua hanga ia kupu tūmataiti.

Me ērua ngā pū he `https`: ka ārai te ratonga ihirangi i te http tūturu i te
wāhanga whakaputanga, ā, me kore rātou e tohono i tētahi rohe e taea te rēhita.
Ka tū te TLS i te ratonga `proxy` mō ērua (tirohia "TLS"); ka ārai te
`init-env.sh` i tētahi pū `http://`.

Ka tīmata te kōpae i te tātari tūturu, ā, ka tatari ia kaupapa i tērā i mua i a
ia:

1. Ka noho ora te `postgres`. I te tīmata tuatahi ka tautuhi tana pūmanawa init
   (`docker/postgres/init/90-passwords.sh`) i ngā kupuhipa ē whā o ngā tūwāhi.
2. `migrate` ka whakamahia ia whakawhiti kaupapa, ā, ka whakatīmata te rārangi
   tatari i te pūtaka whakahaere me ia pūtaka motuhake o te wāhanga, ka tātaritia
   te ōrite o ē rātou whakataunga, kātia ka wehea (docs/ops/upgrade.md). Ka tū ngā
   whakawhiti i ia tīmata kia ōrite, nō reira ko te whakahou tētahi whakaahua
   hou me te tīmata anō.
3. `init` (`apps/web/src/first-run.ts`) ka tuhipoka te pūtaka taupānga i raro i
   te `QUIRE_DATABASE_ID`, ā, i te wā tautuhia ana te `QUIRE_SETUP_ADMIN_EMAIL`,
   ka hanga te tuatahi rōpū me tana kaiwhakahaere. Ka tāia te wāhi hono mai me
   tētahi kupuhipa e hangaia ana kotahi wā, i te rārangi pūrongo `docker compose
   logs init`.
4. `web`, `content`, `worker`, `scheduler`, `collab` me te `centrifugo` ka
   tīmata.
5. Ka tīmata te `proxy` i te wā ora te `web` me te `content`.

Tuwherahia te `https://demo.` i muri i tō ingoa taupānga (ka tāia te wāhi hono
mai tino tika i te rārangi pūrongo `init`), ā, hono atu. I te whakaturanga
ā-rohe, whakawhirinaki tuatahi i te mana tiwhikete o te proxy (tirohia "TLS").
Hurihia te kupuhipa e hangaia ana i te `/account/security`.

Te pū e tīmata ana me te kore kupu tūmataiti e hiahiatia ana ka ārai ia te
tīmata, ā, ka whakaatuhia i tana rārangi pūrongo te tautuhinga kāore. Kāore e
tīmata tētahi mea i te waenganui whakaturanga.

## Ngā ratonga me ngā profile <!--quire:services-and-profiles-->

| Ratonga | Profile | Te mahi |
| --- | --- | --- |
| postgres | i ngā wā katoa | Te pūtaka (PostgreSQL 18 me te pgvector, i hangaia mai i te `docker/postgres.Dockerfile`), me te WAL e kohia ana mai i te whakatīmata tuatahi |
| migrate, init | i ngā wā katoa | Tukanga kotahi: ngā whakawhiti, kātia te tīmata tuatahi |
| web | i ngā wā katoa | Te LMS, i te `QUIRE_HTTP_PORT` (8080) |
| content | i ngā wā katoa | Te pū o te ihirangi kāore e whakawhirinaki, i te `QUIRE_CONTENT_PORT` (8081) |
| worker | i ngā wā katoa | Ngā mahi i muri: ngā īmēra, ngā pūrongo, te whakamahia kōnae, ngā webhook |
| scheduler | i ngā wā katoa | Ngā mahi hōtaka: e rēhitatia ana ngā 64 mahi whakarite wā o te wā mahi, ā, ka tukuna rātou ki te kai mahi; tētahi kai ārahi i te wā kotahi |
| collab | i ngā wā katoa | Te websocket whakatika ngātahi, i te `QUIRE_COLLAB_HTTP_PORT` (1234) |
| centrifugo | i ngā wā katoa | Te tukunga tūturu, i te `QUIRE_REALTIME_PORT` (8000) |
| proxy | i ngā wā katoa | Te Caddy, te tomokanga matua TLS i ngā poro 80 me 443 (tirohia "TLS") |
| valkey | `cache` | Te kohinga me ngā ārahi tere |
| clamav | `scan` | Te tiro i ngā pūkino i ngā tuku |
| gotenberg | `preview` | Ngā tiro mua Office ki PDF, te whakaahua tohu whakaae |
| imgproxy | `images` | Ngā whakaahua kua whakarerekē rahinga me te āhua |
| transcoder | `video` | Te whakaahua o te kai mahi me tētahi ffmpeg LGPL anake, mō ngā āhua ataata |
| seaweedfs | `storage` | Te kohinga āhuatanga S3-whakarite i tēnei pūrere |
| otelcol | `observability` | He kaiwhakohi OpenTelemetry |
| mailpit | `devmail` | Ka mau ia ngā īmēra e tukuna ana, mō te whakamātau i a Quire |
| backup | `backup` | PupuniBackup kotahi wā; tirohia backup-restore.md |
| backup-scheduler, backup-offsite | `backup` | He pupuniBackup ia `QUIRE_BACKUP_INTERVAL_HOURS` haora, me ngā tārua kua uhipu i waho o te pūrere me tētahi whakamātau tautara ia wiki |
| h5p | `h5p` | Te whakaahua rākau LTI 1.3 H5P e tukuna ana e koe i te `QUIRE_H5P_IMAGE`, i te `QUIRE_H5P_PORT` (8090); tirohia "Te hono i tētahi kaiwhakarato H5P" |

Ka tīmata te `--profile full` ia ratonga kōwhiria katoa engari te `backup` me te
`h5p`. Tīmata tētahi ma te `docker compose -f docker/compose.yaml --profile scan
up -d`. Me te kore ratonga kōwhiria, ka mahi tonu a Quire, ā, ka kōrerotia te mea
kāore: me te kai tiro, ka kohia ngā tuku kāore kua tirohia, ā, ka whakamōhiohia te
kaiwhakahaere; me te Gotenberg, ka tuku ngā kōnae i te tukunga ehara i te tiro
mua; me te kai whakawhiti, ka whakatangihia te ataata i te kōnae ōna ake.

Ka tuhia ia whakaahua tuatoru me ōna utu raihana i te
`docker/third-party-containers.yaml`.

### Te hono i tētahi kaiwhakarato H5P <!--quire:connecting-an-h5p-provider-->

Kāore e whakakō a Quire rānei e tuku i tētahi pū mahi H5P rānei pū tautoko (ADR
0019). Mēnā ka whakamahia koe i te H5P, tukua tō ake H5P kua tuku rānei
whakahaerea tō ake H5P e noho ana i motuhake i waho o a Quire. Rēhitatia tērā
kaiwhakarato hei rākau o waho LTI 1.3, ā, tāpiritia tana ihirangi ki ngā
akoranga hei mahi rākau. Ka whakawhiti a Quire ngā tohu me te whakapae ako me te
whakapae aromatawai ma te LTI Assignment and Grade Services (AGS). Mēnā ka tuku
hoki te kaiwhakarato i ngā kōrero xAPI, tautuhia tēnei motuhake mō te kohinga
kōrero xAPI o Quire; kāore te whakawhiti tohu me te whakapae AGS e tuku i ngā
kōrero xAPI. Ka whakaatuhia ngā mahi H5P i ngā whakaurunga Moodle hei mea e
hiahiatia ana tētahi hono rākau LTI. Ka noho tonu te kaiwhakarato te mea e mana
ana i tana pū mahi H5P, tana hanga, tana pātengi ihirangi me tana whakapapa
whakamātau.

Kia tū tō ake H5P e whakahaeretia ana e koe i tēnei pūrere, tautuhia te
`QUIRE_H5P_IMAGE` ki tōna whakaahua, ā, tīmata te profile `h5p`. Ka tukua te
Compose i a ia i te `QUIRE_H5P_PORT` (8090), ā, ka noho ōna raraunga i te volume
`h5p-data`; ko tō ake te whakaahua, me ē utu e tae mai ana i a ia.

## Ngā tautuhinga <!--quire:settings-->

Ka pānui ia pū te `docker/.env`. Ko te tauira, te `docker/.env.example`, he
rārangi ia i ia tautuhinga me tana uara tūtohu. Ngā rōpū:

### Ngā wāhi <!--quire:addresses-->

| Tautuhinga | Tikanga |
| --- | --- |
| `QUIRE_APP_ORIGIN` | Te wāhi tūmatanui o te LMS, pērēi i te `https://learn.example.com` |
| `QUIRE_CONTENT_ORIGIN` | Te pū o te ihirangi, tētahi pūrere rerekē |
| `QUIRE_PLATFORM_DOMAINS` | Ngā rohe e noho ana ngā rōpū, e wehea ana e te tōmau |
| `QUIRE_MARKETING_ORIGIN` | Optional. The marketing site, default `https://quirelms.com`. The only origin the waitlist form (`POST /api/waitlist`, `POST /waitlist`) accepts and redirects to. Comma separated; a `www.` variant is allowed only if listed |
| `QUIRE_DEPLOY_TARGET` | `compose` i konei. Tirohia ērā atu aratohu mō te `vercel` me te `cloudflare` |
| `QUIRE_TRUSTED_PROXY_CIDRS` | Ngā proxy e whakaaetia ana tō rātou `X-Forwarded-For` |

### Ngā kupu tūmataiti <!--quire:secrets-->

| Tautuhinga | Tikanga |
| --- | --- |
| `QUIRE_SECRET_KEY` | Ka tāia ngā hono me ngā tohu. 64 pātuhi hex |
| `QUIRE_MASTER_KEY` | Ka whakakapi i ngā tohu whakamanatanga kua kohia pērēi i te SSO me ngā kupu tūmataiti webhook. 32 byte, base64. Me ōrite te uara e hiahiatia ana e te wāhanga ipurangi me te kai mahi. Te hurihuri: [key-rotation.md](/mi/ops/key-rotation/) |
| `QUIRE_MASTER_KEY_VERSION` | Te tohuāhua o te kī matua, te `v1` mēnā kāore e tautuhia. Whakanuia ia i te wā hurihuri |
| `QUIRE_MASTER_KEY_RETIRED` | Ngā kī matua o mua e hiahiatia tonu ana te pānui i ē kua kāingia, ma te `v1=<base64>`. Tangohia i muri i te oti o tētahi hurihuri, me te kore mea kāore kua whakataunga |
| `QUIRE_COLLAB_SIGNING_KEY` | E tohonoa ana e web me collab te tā i ngā tohu whakatika |
| `QUIRE_BACKUP_SIGNING_KEY` | Ka tāia ngā pupuniBackup akoranga (kōwhiria) |

Pupuritia tētahi tārua o te `QUIRE_MASTER_KEY` i tētahi wāhi kē i tēnei
pūrere. Kāore e taea e tētahi pūtaka kua whakahoki te wehenga i ēna tohu
whakamanatanga e pupuri ana ia me te kore ia.

### Te pūtaka <!--quire:database-->

| Tautuhinga | Tikanga |
| --- | --- |
| `POSTGRES_PASSWORD` | Te kaiwhakamahi matua, e whakamahia ana e te ipupā me ngā pupuniBackup |
| `QUIRE_DB_APP_PASSWORD`, `QUIRE_DB_MIGRATOR_PASSWORD`, `QUIRE_DB_REPORT_PASSWORD`, `QUIRE_DB_AUDIT_PASSWORD` | Ngā kupuhipa tūwāhi, e tautuhia ana i te tīmata tuatahi |
| `DATABASE_URL` | Te tūwāhi taupānga. Ka pā te haumarutanga ā-rārangi ia tono e mahia ana e ia |
| `DATABASE_MIGRATOR_URL`, `QUIRE_MIGRATION_URL` | Te tūwāhi whakawhiti, mō te `migrate` me te `init` |
| `QUIRE_SUPERUSER_URL` | E whakamahia ana e te tīmata tuatahi anake |
| `QUIRE_REPORT_DATABASE_URL` | Te tūwāhi pūrongo pānui-anake, mō ngā pūrongo me te kaihanga pūrongo |
| `QUIRE_AUDIT_DATABASE_URL` | Te tūwāhi arotake, mō te papa arotake me te tāruatanga SIEM |
| `QUIRE_DATABASE_ID` | He UUID kē, e tautuhia ana mō te ora o te whakaturanga |

Ka tautuhia ngā kupuhipa tūwāhi i te wā anake ka hanga te wāhi pupunga pūtaka
tuatahi. Kia huri i tētahi i muri mai, whakamahia te `ALTER ROLE`, kātia ka
whakahou te URL whakarite.

Ka whakamahia te `QUIRE_REPORT_DATABASE_URL` mō te pūtaka ā-tinana e tautuhia
ana e te `DATABASE_URL`. Mō ia pūtaka motuhake rēhita atu, tautuhia tōna ake
`quire_report` wāhi hono i ngā taiao o web me te worker, kātia ka tāropia te
ingoa i te āpure **Te tautuhinga taiao pūrongo** o tēnei pūtaka ma te `env:NAME`.
Me tū te tohunga ki te tahi pūtaka me tana hono taupānga, i tōna tino pai ko
tana tārua pānui. Ka tae ia wāhanga pūrongo ki te hono pūrongo o te pūtaka ōna
ake o te wāhanga: te kaihanga pūrongo me ngā pūrongo kua tiakina, ngā tuku
takotahi, ngā tāruatanga pūrongo, ngā tatauranga, te rārangi arotake, ngā rauemi
arotake REST me te rapu arotake o te kaiwhāwhina. Kāore tētahi o rātou e whakauru
i te hono pūrongo o tētahi atu pūtaka. I te wā kāore hono pūrongo tētahi pūtaka,
ka tū ngā pūrongo tūmatanui i te hono taupānga ōna ake o tētahi pūtaka, engari ka
ārai ngā tatauranga me ia pānui arotake, ā, ka kōrerotia tēnei, i te mea kāore e
taea e te tūwāhi taupānga te pānui i te ara arotake.

### Ngā kaiwhakarato <!--quire:drivers-->

| Tautuhinga | Te whakaputanga nei | Tuhipoka |
| --- | --- | --- |
| `QUIRE_STORAGE_DRIVER` | `local` (tūtohu), `s3` rānei `azure` | `local` ka noho ngā kōnae i te volume `files`. Ka ārahi te `s3` i te AWS S3, te R2, te whakarite GCS me ētahi atu kohinga S3-whakarite, me ngā tuku maha e taea te tukina anō |
| `QUIRE_REALTIME_DRIVER` | `inprocess` (tūtohu), `sse`, `centrifugo` rānei `durable_objects` | He tika te `inprocess` mō tētahi ipupā web kotahi; whakamahia te `centrifugo` rānei te `sse` inā he tino maha |
| `QUIRE_CACHE_DRIVER` | `memory` (tūtohu), `postgres` rānei `valkey` | He ia pū te `memory`; whakamahia te `valkey` rānei te `postgres` kia noho ngā ārahi tere i waenga i ngā ipupā |
| `QUIRE_VIDEO_DRIVER` | `ffmpeg` (tūtohu) rānei `progressive_mp4` | Rānei tētahi kaiwhakarato tuku: Cloudflare Stream, Mux rānei Bunny, ma ā rātou kī |
| `QUIRE_IMAGE_DRIVER` | `noop` (tūtohu), `imgproxy` rānei `cloudflare` | Ka tuku te `noop` ia whakaahua i tana rahinga tūturu. Ka hiahiatia e te `imgproxy` te profile `images` me ngā tautuhinga raro; ka whakamahia te `cloudflare` te Cloudflare Images |
| `QUIRE_MEETING_PROVIDER` | `bbb`, `zoom`, `teams`, `meet`, `jitsi` rānei `in_process` | Te tūtohu o te pū mō ngā hui-ora. Mēnā kāore e tautuhia, ka kōrerotia e ngā hui-ora kāore rātou e tautuhia, tae noa ki te hono tētahi rōpū i tōna ake pūkete i raro i Ngā hononga, te kaiwhakarato hui-ora. Ka tika ake te pūkete ake o tētahi rōpū i tēnei uara i ngā wā katoa. Ka pānuitia anake ngā tautuhinga ōna ake o ia kaiwhakarato (`BBB_URL` me te `BBB_SECRET`, ngā tūhu `ZOOM_*`, `TEAMS_*`, `GOOGLE_MEET_*` me te `JITSI_*`) mō te kaiwhakarato e kīia ana i konei |
| `QUIRE_MEETING_REGIONS` | He rārangi tōmau o te `eu`, `uk`, `us` | I hea e tahua ana te kaiwhakarato tūtohu ngā hui-ora. Mēnā kāore e tautuhia, kāore e tātaritia ia ki tētahi rōpū e pūmau ana ki tētahi rohe, i te āhua o mua. Ka kōrerotia e te pūkete ake o tētahi rōpū ōna rohe i tōna whārangi |

Ka ārai ia uara kaiwhakarato kāore e ārahi ana te whakaputanga nei i te
wā tīmata o te wāhanga ipurangi, me te tohu te tautuhinga, ehara i te
whakakapia i te tūtohu i te pōuri.

### Ngā whakaahua <!--quire:images-->

Ka tono ngā whārangi i ngā whakaahua i ē whā rahinga tūturu ma te
`/api/files/{id}/image/{size}`, e tātaritia ana te whakaae kotahi me te
kōnae tēnei a ia, kātia ka whakawhiritia ki te ratonga whakaahua. Ka āea te
whā i ia rā te tono i ē tauira whakaahua hou me te rahinga `QUIRE_IMAGE_SPECS_PER_HOUR`
(tūtohu 2000) ia haora; kāore e tata ngā rahinga kua hanga kē i tērā haora.
Whakamahia te `valkey` rānei te `postgres` mō te `QUIRE_CACHE_DRIVER` me te tino
maha ipupā web, kia noho te ārahi i waenga i a rātou.

| Tautuhinga | Kaiwhakarato | Tuhipoka |
| --- | --- | --- |
| `IMGPROXY_URL` | `imgproxy` | Te wāhi e tae ana ngā pūhukapuka ki te imgproxy, hei tauira `https://images.example.org`. Ka tukua te profile `images` i a ia i te `QUIRE_IMAGES_PORT` (8082) |
| `IMGPROXY_KEY`, `IMGPROXY_SALT` | `imgproxy` | Ngā rārangi hex, ē rātou uara kotahi ā me ē whakatīmata ana te imgproxy. Hanga ia tētahi ma te `openssl rand -hex 32`. Ka tāia e Quire ia wāhi whakaahua ma ā rātou, nō reira kāore e whakaahua te imgproxy i tētahi mea kāore e tonoa e Quire |
| `QUIRE_IMAGE_SOURCE_ORIGIN` | `imgproxy` me te kohinga ā-rohe | I hea e tikina ana te imgproxy ngā tūturu. Ka tautuhi te Compose i te `http://web:3000`. Me te kohinga `s3` rānei `azure` ka tikina e te imgproxy mai i te pākete, ā, kāore e whakamahia tēnei |
| `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_IMAGES_TOKEN`, `CLOUDFLARE_IMAGES_ACCOUNT_HASH` | `cloudflare` | He tohu API me te whakaaetanga whakatika Images, me te tohunga pūkete mai i te Images, ngā rauemi kaihang. Whakawāhia ngā āhua ōrite mō te pūkete |
| `CLOUDFLARE_IMAGES_SIGNING_KEY` | `cloudflare` | Kōwhiria. I te wā tautuhia, he tūmataiti ngā whakaahua, ā, ka tāia ia wāhi, ā, ka mutu tana ora. Me te kore, he tūmatanui ngā whakaahua i ngā wāhi whakaputanga mai i te `QUIRE_SECRET_KEY` kāore e taea e te tāngata kotahi te whakatakaro. |

Ka noho a Cloudflare Images i tōna ake tārua o ia whakaahua tūturu e tuku
ana. I te wā mukua tētahi kōnae, ka mukua e te kai mahi tērā tārua i mua
i te tūturu.

### Te rārangi tatari <!--quire:queue-->

Ka whakamahia ngā mahi i muri te pg-boss i te tahi pūtaka PostgreSQL, nō
reira kāore he ratonga rārangi tatari te tīmata me te mea te tautuhinga.
Ka tukuhia ngā mahi i te tahi whakawhitinga me te huringa i tū ai rātou,
nō reira kāore e taea i tētahi raru te ngaro i tētahi rānei te tuku i a
ia rua wā. Ko te `QUIRE_QUEUE_DRIVER` ko te `pgboss` i konei, ko tana tūtohu;
ko te `vercel` me te `cloudflare` ka neke anake i ngā whakamōhiotanga māmā me
ngā tuku webhook ki te rārangi tatari ōna ake o te pū, ā, ka ārahitia ēnei e
ngā aratohu Vercel me Cloudflare, ā, te āhua e tukuhia ai e ō rātou wāhanga
ipurangi.

### Īmēra <!--quire:email-->

Tautuhia tētahi o ēnei:

- `QUIRE_EMAIL_PROVIDER_CONFIG`: tētahi āhuatanga JSON e tohu ana tētahi
  kaiwhakarato HTTP me ōna tohu whakamanatanga, pērēi i te
  `{"provider":"postmark","token":"..."}`. Ka tautokotia te Postmark, te Amazon
  SES, te Mailgun, te SendGrid me te Resend.
- `QUIRE_SMTP_URL`: `smtp://user:password@host:587`. Tēnei wāhi anake; ka ārai ē
  atu wāhi i te SMTP.

Ko te `QUIRE_MAIL_FROM` te kaiwhakawhiti. Mō te whakamātau i a Quire, tīmata te
profile `devmail`, tautuhia te `QUIRE_SMTP_URL=smtp://mailpit:1025`, ā, pānuitia
te īmēra i te `http://localhost:8025`.

### Ngā ratonga kōwhiria <!--quire:optional-services-->

| Tautuhinga | Me te profile |
| --- | --- |
| `CLAMAV_URL=tcp://clamav:3310` | `scan` |
| `GOTENBERG_URL=http://gotenberg:3000` | `preview` |
| `IMGPROXY_KEY`, `IMGPROXY_SALT` | `images` |
| `VALKEY_URL=redis://valkey:6379` | `cache` |
| `QUIRE_OPENSEARCH_URL` rānei `QUIRE_MEILISEARCH_URL` | Rapu o waho; mā te kupu katoa o te PostgreSQL mēnā kāore |
| `QUIRE_BREACH_CHECK_PROVIDER=off`, `QUIRE_BREACH_CHECK_URL` | Te tiro kupuhipa kua tukingia. Ke i te tūtohu ki te `api.pwnedpasswords.com` (kāore e tukuna ana i te wehenga kupu hex e rima anake); ka ārai te `off` i a ia, ā, ka tū te URL ki tētahi API rārohi e whakahaeretia ana e koe |

### Te aroturuki <!--quire:observability-->

Ko te `OTEL_EXPORTER_OTLP_ENDPOINT` te tohu o te kaiwhakohi e tukuna ana ia
pū ngā mātātai me ngā ōrongotau ki a ia; me te profile `observability` ko te
`http://otelcol:4318`, ā, ko te `docker/otel-collector.yaml` te wāhi e tāpiritia
ana te kaiwhakawhaki mō tō pūhokihoki. Ka tuku ngā wāhanga ipurangi, te
kai mahi, te kaiwhakarite, te ihirangi me te collab i ngā taki ma te
OTLP/HTTP (ngā tono ipurangi, ngā whakawhinga pūtaka wāhanga, ngā mahi kai mahi
me ngā karenga whakawāhi) i te wā tautuhia, ā, ngā ōrongotau ki te tahi wāhi
ia meneti (`OTEL_METRICS_EXPORTER=none` ka whakawāhia rātou). Ko te
`OTEL_TRACES_SAMPLER_ARG` te tautuhinga o te wehenga mātātai e pupuria ana.
Ka tukuna ngā rārangi ki te tuku tūturu i te `LOG_LEVEL`, ā, ka hurihuri
te Compose i a rātou. Kāore e kawe ngā mātātai i tētahi raraunga tangata.

### Te tukunga ā-rohe (te noho raraunga UE) <!--quire:regional-egress-eu-data-residency-->

Ko te `QUIRE_REGION=eu` te kōrero he rōpū Uniana Ūropē e tuku ana te kōpae.
Ka ārahi i muri i tēnei te kai mahi ia tono whakawāhi e mahia ana mō tētahi
rōpū e pūmau ana ki te UE ki tētahi rārangi whakaae (21-compliance.md
wāhanga 8.1). Ko te rārangi whakaae ngā kaiwāhi e whakaatura ana ngā ratonga
e tautuhia ana mō tēnei rohe (te wāhi kohinga, te kaiwhakarato īmēra, tētahi
kaiwhakarato ataata tuku, ngā wāhi kohinga ōna ake o te rōpū, ngā kaiwhakarato AI
me te pūkete īmēra), ngā kaiwāhi o ia ratonga i raro i tētahi whakarara tūturu,
me ngā kaiwāhi e tuhia ana e koe i te `QUIRE_EGRESS_ALLOW_HOSTS`. Ka āraihia
ia tono ki tētahi atu kaiwāhi tūmatanui i mua i te tukuna, ka tuhia te ārai
ki te ara arotake o te rōpū ma te `privacy/egress_refused`, ā, ka tuhia ia i
raro i te Whakaaetanga, te Noho raraunga.

| Tautuhinga | Ngā uara | Te mahi |
| --- | --- | --- |
| `QUIRE_EGRESS_ALLOW_HOSTS` | He rārangi tōmau o ngā ingoa kaiwāhi, rānei te `*.example.org` mō ia wāhanga-ā-raro | Ētahi atu kaiwāhi e āea ana te tae mai e tētahi rōpū UE. Ka tū ki konei ngā wāhi tapae webhook, xAPI me SIEM, ngā rārangi pūkōrero me ngā kaiwāhi Amazon SES, i te mea he kōwhiri ōna ake o te rōpū ēnei, ā, kāore e whakaatura ia ratonga. He tō ā pūnaha ā-rohe ngā wāhi hoki me ngā ingoa kōtahi kupu pērēi i te `web` rānei te `clamav`, ā, kāore rātou e tātaritia i ngā wā katoa |

Kāore e āraihia ē rōpū UK me US ki tētahi rārangi kaiwāhi; ka noho tonu
rātou i ngā tātaritanga rohe ratonga. Tautuhia te rārangi i te kai mahi; ka
pānui te whārangi whakahaere i a ia i te wāhanga ipurangi kia whakaatuhia te
rārangi whakaae, nō reira tāropia ia i te `docker/.env`, e pānui ana ia
ratonga.

Ka tuku te tātaritanga taupānga i tētahi hapa mārama me tētahi tuhipoka
arotake, ā, ehara i te tūpono: ka āea te waehere te hē. Ko te tūpono ko te
kupenga. Kāore e whakarite te Compose i tēnei mō a koe. Mō tētahi kōpae
ā-rohe, whakarite ngā ratonga `worker` me `web` ki tētahi kupenga `internal:
true`, ā, kāore he ara whakawāhi engari tētahi proxy tukunga (hei tauira tētahi
ipupā Squid rānei tinyproxy) e whakaae ana i ngā tahi kaiwāhi me te
`QUIRE_EGRESS_ALLOW_HOSTS` me ē kaiwāhi o ō ratonga e tautuhia ana, ā, tautuhia
te `HTTPS_PROXY` mō ērā ratonga. Ka tuhia i te whārangi noho raraunga ngā
kaiwāhi tino tika e whakaaetia ana e te taupānga, kia taea te whakatauranga
i ē rārangi e rua.

## Te hauora <!--quire:health-->

| Tapae | Tikanga |
| --- | --- |
| `/healthz` | Te ora: ka whakautu te pū. Ka whakamahia tēnei e ngā tātaritanga hauora o te Compose |
| `/readyz` | Te wātea: ka taea te tae ki ngā whai hanganga, ā, ka rongo ia ratonga kōwhiria te tautuhinga rānei kāore. Tūhono tō kai wehenga ki konei |

Ka whakaatuhia te `docker compose -f docker/compose.yaml ps` te hauora o ia
ratonga.

## TLS <!--quire:tls-->

Ko te ratonga `proxy` (te Caddy, Apache-2.0, `docker/caddy/Caddyfile`) he wāhanga
o te kōpae tūtohu. Ka whakautu ia i ngā poro 80 me 443, ā, ka tohutohu:

| Kaiwāhi rānei ara | Ka tukuna ki |
| --- | --- |
| `QUIRE_PROXY_CONTENT_HOST` | `content` |
| `QUIRE_PROXY_APP_HOST`, ia wāhanga-ā-raro o te wāhanga me te rohe whakarau | `web` |
| `/_collab/` i ēna kaiwāhi | `collab` (websocket, `QUIRE_COLLAB_URL`) |
| `/_realtime/connection/` i ēna kaiwāhi | te websocket kaihoko o te `centrifugo`; kāore e whakaaturia i ngā wā katoa tana API tūmau |
| `/_images/` i ēna kaiwāhi | `imgproxy`, me te profile `images` (`IMGPROXY_URL`) |

Ka whakaputanga te `init-env.sh` i te `QUIRE_PROXY_APP_HOST`, te
`QUIRE_PROXY_CONTENT_HOST`, te `QUIRE_PROXY_HTTPS_PORT`, te `QUIRE_COLLAB_URL` me
te `IMGPROXY_URL` mai i ē pū e rua, nō reira kāore e taea te wehenga i a
rātou. Whakatikaina rātou ngātahi mēnā ka huri koe i tētahi pū i te ringa.

Ka whai ngā tiwhikete i te `QUIRE_PROXY_TLS`:

- `internal` (te tūtohu): te mana tiwhikete ōna ake o te Caddy, mō te
  `localhost`, te `*.localhost` me te `lvh.me`. Whakawhirinaki tō pūhono tuatahi,
  kātia, ā, tirohia:

  ```sh
  docker compose -f docker/compose.yaml cp \
    proxy:/data/caddy/pki/authorities/local/root.crt ./quire-local-ca.crt
  ```

  Tāpiritia te `quire-local-ca.crt` ki te pūrunga whakawhirinaki o te pūrere
  rānei o te pūhukapuka. Ka āea te `curl` te tango i a ia ma te `--cacert`.
- Tētahi wāhi īmēra: ngā tiwhikete ACME ā-oto (Let's Encrypt, kātia te ZeroSSL)
  mō ngā ingoa kaiwāhi tūturu. Me tū te DNS mō ē pū e rua me ia kaiwāhi
  wāhanga ki konei, ā, me taea te tae mai ki ngā poro 80 me 443 mai i te
  ipurangi.

Ka tukua ngā kaiwāhi wāhanga i te wā tonoa, i te tiro tuatahi, ā, i te wā
anake e whakaaea ana e te ipurangi ko tōna ingoa te tū tika ki tēnei
whakaturanga (`/tls-allowed`, e pātaihia ana i te kupenga Compose). Kāore e
hiahiatia tētahi tiwhikete whakawhiti rānei tētahi pūwāea DNS, ā, kāore e
taea e tētahi kāore e mōhio ana e tū tētahi ingoa ki te pūrere te tono i
ngā tiwhikete. Kei te volume `caddy-data` ngā tiwhikete me te mana ā-rohe; tārua
rātou me ē atu mēnā ka whakamahia koe i te `internal`.

Ka whakaaetia e te proxy anake te `X-Forwarded-For` o te web: he wāhi tūturu
te proxy (`QUIRE_PROXY_ADDRESS`, tūtohu `172.29.64.10`) i tētahi tapa subnet
(`QUIRE_COMPOSE_SUBNET`), ā, ko te `QUIRE_TRUSTED_PROXY_CIDRS` te tohu i tērā
wāhi. Mēnā ka tukutahi te subnet me tētahi kupenga i te pūrere, hurihia ērua,
ā, whakatēngia te `docker compose down` i mua i te `up`.

## I muri i tō ake proxy whakamuri <!--quire:behind-your-own-reverse-proxy-->

Mō te whakamahi i tētahi kai wehenga rānei proxy kua tū kē i tō mana, waiho
i waho te `proxy` (`docker compose up -d --scale proxy=0`), ā, whakakore i te
TLS i mua i te `web` (8080), te `content` (8081), te `collab` (1234, websocket)
me te `centrifugo` (8000, websocket). Tautuhia ngā wāhi tūmatanui i te
`QUIRE_APP_ORIGIN`, te `QUIRE_CONTENT_ORIGIN` me te `QUIRE_COLLAB_URL`
(`wss://`), ā, te tawāhi o tō proxy i te `QUIRE_TRUSTED_PROXY_CIDRS`.

## Te rapu i ngā raru <!--quire:troubleshooting-->

- Ka wehea te `init` me te "QUIRE_DATABASE_ID is not a UUID": tautuhia ia ma te
  `uuidgen`.
- Ka tīmata anō te `web` me te "did not start on compose": ka tuhia i te
  rārangi ia tautuhinga kāore e taea te ārahi, me te mea e whakamahia
  ana i tōna place.
- Kāore e mahi te huri kupuhipa tūwāhi i te `.env` i muri i te tīmata
  tuatahi: ka tū te pūmanawa init kotahi wā. Whakamahia te `ALTER ROLE`.
- Ka rahua ngā tuku me tētahi hapa tiro i te wā tautuhia te `CLAMAV_URL`:
  ka tukua te ClamAV ōna tohu i te tīmata tuatahi, ā, ka tae tēnei i te tahi
  meneti.

Source: https://docs.quirelms.com/mi/ops/install/index.mdx