add bookorbit service and refine proxy rules for radarr/sonarr

download/compose.yaml

@@ -57,9 +57,12 @@ services:
       pangolin.proxy-resources.radarr.rules[1].match: ip
       pangolin.proxy-resources.radarr.rules[1].action: allow
       pangolin.proxy-resources.radarr.rules[1].value: 172.21.0.1
-      pangolin.proxy-resources.radarr.rules[2].match: country
-      pangolin.proxy-resources.radarr.rules[2].action: deny
-      pangolin.proxy-resources.radarr.rules[2].value: ALL
+      pangolin.proxy-resources.radarr.rules[2].match: path
+      pangolin.proxy-resources.radarr.rules[2].action: allow
+      pangolin.proxy-resources.radarr.rules[2].value: /api/*
+      pangolin.proxy-resources.radarr.rules[3].match: country
+      pangolin.proxy-resources.radarr.rules[3].action: deny
+      pangolin.proxy-resources.radarr.rules[3].value: ALL
     network_mode: "bridge"
     ports:
       - "7878:7878"
@@ -152,9 +155,12 @@ services:
       pangolin.proxy-resources.sonarr.rules[1].match: ip
       pangolin.proxy-resources.sonarr.rules[1].action: allow
       pangolin.proxy-resources.sonarr.rules[1].value: 172.21.0.1
-      pangolin.proxy-resources.sonarr.rules[2].match: country
-      pangolin.proxy-resources.sonarr.rules[2].action: deny
-      pangolin.proxy-resources.sonarr.rules[2].value: ALL
+      pangolin.proxy-resources.sonarr.rules[2].match: path
+      pangolin.proxy-resources.sonarr.rules[2].action: allow
+      pangolin.proxy-resources.sonarr.rules[2].value: /api/*
+      pangolin.proxy-resources.sonarr.rules[3].match: country
+      pangolin.proxy-resources.sonarr.rules[3].action: deny
+      pangolin.proxy-resources.sonarr.rules[3].value: ALL
     network_mode: "bridge"
     ports:
       - "8989:8989/tcp"
@@ -509,6 +515,73 @@ services:
       - "5008:5000"
     restart: unless-stopped
 
+  # https://github.com/bookorbit/bookorbit
+  # Requires BOOKORBIT_DB_PASSWORD, BOOKORBIT_JWT_SECRET and BOOKORBIT_SETUP_TOKEN
+  # (see vaults3 for how secrets are supplied). First-time setup token is shown in the web UI.
+  bookorbit:
+    image: ghcr.io/bookorbit/bookorbit:2.10.0
+    container_name: bookorbit-app
+    network_mode: bridge
+    ports:
+      - "3099:3000"
+    environment:
+      TZ: Europe/Berlin
+      NODE_ENV: production
+      PORT: 3000
+      PUID: 99
+      PGID: 100
+      APP_URL: http://192.168.10.144:3099
+      POSTGRES_HOST: 192.168.10.144
+      POSTGRES_PORT: 5434
+      POSTGRES_USER: bookorbit
+      POSTGRES_PASSWORD: ${BOOKORBIT_DB_PASSWORD}
+      POSTGRES_DB: bookorbit
+      JWT_SECRET: ${BOOKORBIT_JWT_SECRET}
+      SETUP_BOOTSTRAP_TOKEN: ${BOOKORBIT_SETUP_TOKEN}
+    depends_on:
+      bookorbit-db:
+        condition: service_healthy
+    volumes:
+      - /mnt/user/books:/books
+      - /mnt/user/appdata/bookorbit/app:/data
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+    security_opt:
+      - no-new-privileges:true
+    stop_grace_period: 30s
+    restart: unless-stopped
+
+  bookorbit-db:
+    image: pgvector/pgvector:pg18
+    container_name: bookorbit-db
+    network_mode: bridge
+    ports:
+      - "5434:5432"
+    environment:
+      TZ: Europe/Berlin
+      POSTGRES_USER: bookorbit
+      POSTGRES_PASSWORD: ${BOOKORBIT_DB_PASSWORD}
+      POSTGRES_DB: bookorbit
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - /mnt/cache/appdata/bookorbit/db:/var/lib/postgresql/data
+    healthcheck:
+      test: [ "CMD-SHELL", "pg_isready -U bookorbit -d bookorbit" ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    restart: unless-stopped
+
 volumes:
   28eea8bfffd285350962765a88ff04ea9d580fe872771d5c06fd62afb26f2ef2:
     external: true