networks:
  frontend:
    name: frontend
    external: true

services:
  littlefedi:
    image: littlefedi
    build: ./littlefedi
    environment:
      - LITTLEFEDI_AUTH_MFA_ENCRYPTION_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      - LITTLEFEDI_AUTH_REQUIRE_ADMIN_MFA=true
      - LITTLEFEDI_MEDIA_PROXY_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      - LITTLEFEDI_SMTP_PASSWORD=XXXXXXXXXXXXXXXXX
    ulimits:
      nofile: 65536
    restart: unless-stopped
    networks:
      - frontend
    volumes:
      - ./data:/data
      - ./config:/config
      - ./backup:/backup

Notes:

• the frontend network is reverse-proxied through caddy

  xyzzy.cafe {
        reverse_proxy littlefedi:8080
  }
  

• the Dockerfile and the littlefedi sources are located in a littlefedi subdirectory.

• For the value of the environment variables, have a look at littlefedi's documents.

To give it all a spin:

docker compose build littlefedi
docker compose up

#littlefedi #DockerCompose

FROM golang:1.27 AS build

WORKDIR /usr/src/littlefedi

# pre-copy/cache go.mod for pre-downloading dependencies and only redownloading them in subsequent builds if they change
COPY src/go.mod src/go.sum ./
RUN go mod download

COPY src .
RUN make build-blog

FROM debian:trixie-slim
RUN apt-get update && \
    apt install -y --no-install-recommends ca-certificates gosu procps && \
    rm -rf /var/lib/apt/lists/*
COPY --from=build /usr/src/littlefedi/littlefedi-blog /bin/littlefedi
EXPOSE 8080
# Create default app (UID/GID 1000)
RUN groupadd --gid 1000 app && \
    useradd --uid 1000 --gid 1000 --comment "" app
RUN mkdir /config 
RUN mkdir /data
RUN mkdir /backup
VOLUME /config
VOLUME /data
VOLUME /backup
COPY entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/entrypoint.sh

ENTRYPOINT ["entrypoint.sh"]
CMD ["/bin/littlefedi", "--config", "/config/littlefedi.toml"]

I'm using the "official" golang docker image here to build littlefedi from the expanded littlefedi source tar placed in the src subdirectory.

A couple of notes:

• I want to have the blog-enabled variant of littlefedi, hence the make build-blog incantation.

• I'm pretty much only interested in the littlefedi binary, thus, the multi-stage docker file: I pull a slim Debian image for the final docker image and copy the generated littlefedi-blog into it (renaming it to littlefedi).

• To enable littlefedi to do TLS certificate verifications we need the ca-certificates package installed, we need gosu to run littelfedi as non-root, the procps package to install ps (for debugging).

• Given that this is a slim docker container image I just went with

  instead of faffing around with linux filesystem hierarchy standard compliant folder names.

  • /config to hold the littlefedi.toml configuration file,
  • /data to store media
  • /backup to hold littlefedi's backups

To ensure that mounted volumes (/config, data, /backup) are accessible from outside the docker image entrypoint.sh obtains the UID and GID from the mounted /config volume and modifies the app user and group to match:

#!/bin/bash

CONFIG_UID=$(stat -c '%u' /config)
CONFIG_GID=$(stat -c '%g' /config)

usermod -u "${CONFIG_UID}" app
groupmod -g "${CONFIG_GID}" app

# ensure uid:gid are as intended for 
for v in /config /data /backup ; do
    chown -R app:app ${v}  
done

# run the passed-in args (or CMD if none provided)
exec gosu app "$@"

Using gosu we then run littelfedi (or whatever we pass in as commands) as user app:app.

#littlefedi #docker #dockerfile

#photography #iphonephotography #fall #BlueSky