Docker and storage¶

The image is ghcr.io/voc0der/reddont. Images are built for Linux amd64 and arm64, with separate release and nightly channels:

Tag	Updated when
`latest`	A maintainer manually publishes a release.
A release version, such as `0.1.0`	A maintainer publishes that version.
`nightly`	A pull request labeled `nightly` merges into `main`, or a maintainer manually publishes a nightly build.
`nightly-YYYY-MM-DD`, `sha-<short commit>`	The corresponding nightly build is published.

Pushing commits alone does not publish an image. To follow development builds, set your Compose image to ghcr.io/voc0der/reddont:nightly. The default :latest follows manual releases. For an exact image pin, use its digest; tags can be rebuilt. See publishing images for the maintainer workflow.

Start with the working quick-start compose file.

Persistent data¶

Mount a host directory or named volume at /data. The app stores reddont.db there, including accounts, subscriptions, preferences, invites, API keys, and saved Reddit credentials.

volumes:
  - ./reddont-data:/data

PUID and PGID default to 1000. The entrypoint creates a matching container user/group when necessary, adjusts ownership of /data and the application directory, and then runs the app as that user. Set those variables instead of adding Compose's user: setting, which would prevent the entrypoint from doing its initial setup.

Back up both the data directory and your configuration. See backups and updates.

Ports¶

The application listens on 0.0.0.0:3000 by default. A mapping such as 127.0.0.1:9495:3000 makes it available on the Docker host at port 9495. The final number must match REDDONT_PORT inside the container.

For a reverse proxy in another container, attach both services to the same Docker network and use http://reddont:3000 as the upstream address. You can remove the host ports: mapping if all traffic arrives through that proxy. Keep HTTP_BINDING=0.0.0.0 inside the app container so the proxy can reach it.

Apply configuration changes¶

After editing environment variables, recreate the container:

docker compose up -d
docker compose logs --tail=100 reddont

docker compose restart alone does not apply an edited container environment. See the environment reference for defaults.

Check API network access¶

The API defaults to loopback-only access. Requests through a published Docker port or another container can have a bridge or proxy address, so a request from the host may need an explicit API_WHITELIST entry.

From an allowed client, GET /api/v1/health reports the source address reddont sees. Rejected requests log that address. This setting is separate from REVERSE_PROXY_WHITELIST; see API access control.

Build the image locally¶

From a checkout of the repository:

docker build -t reddont:local .

Set image: reddont:local in your compose file to use it. Documentation, Python environments, local screenshots, and databases are excluded from the Docker build context.

Full compose reference¶

The repository's compose file lists the available deployment settings. Adapt its port binding, secret, and cookie settings to your installation; the quick start above supplies a local HTTP configuration.

---
services:
  reddont:
    image: ghcr.io/voc0der/reddont:latest
    container_name: reddont
    environment:
      # --- Docker user/group for file ownership inside /data (defaults shown) ---
      PUID: "1000"
      PGID: "1000"

      # --- Server configuration (defaults shown) ---
      REDDONT_PORT: "3000"
      HTTP_BINDING: "0.0.0.0"

      # --- HTTPS (optional) ---
      # If BOTH paths are set (non-empty), the app will start an HTTPS server.
      # Leave blank to use HTTP (default).
      REDDONT_SSL_CERT_PATH: ""
      REDDONT_SSL_KEY_PATH: ""

      # --- Application settings ---
      LOG_LEVEL: "info"          # debug, info (default), warn, error
      RATE_LIMIT: "100"          # max requests per 15-minute window per IP (default: 100)
      REDDONT_THEME: ""           # optional; name of a CSS file in src/public without ".css" (default: unset)

      # --- Authentication & security ---
      REDDONT_DISABLE_SSL: "false"  # default: "false". Set to "true" to disable the Secure cookie flag (needed for HTTP-only deployments)
      JWT_SECRET_KEY: ""         # auto-generated if unset; set to keep sessions valid across restarts
      REMOTE_HEADER_LOGIN: ""    # default: "false". Set to "true" to enable Remote Header SSO
      ADMIN_GROUP: "admin"       # default: admin (used when REMOTE_HEADER_LOGIN is enabled)
      REVERSE_PROXY_WHITELIST: ""  # comma-separated trusted proxy IPs (default: unset)

      # --- API (/api/v1, per-user API keys) ---
      # Source addresses allowed to reach the API, compared against the direct
      # TCP peer (never X-Forwarded-For). Accepts plain IPs and IPv4 CIDRs.
      # Default when unset/empty: "127.0.0.1,::1" (loopback only).
      # Use "off" to disable the API entirely, "*" to allow any address.
      API_WHITELIST: ""          # e.g. "127.0.0.1,::1,10.2.5.50" or "172.28.0.0/16"
      API_RATE_LIMIT: "600"      # max API requests per 15-minute window per IP (default: 600)

      # --- OIDC (OpenID Connect + PKCE) ---
      OIDC_ENABLED: ""           # default: "false". Set to "true" to enable OIDC
      OIDC_ISSUER_URL: ""        # required if OIDC_ENABLED=true (provider discovery URL)
      OIDC_CLIENT_ID: ""         # required if OIDC_ENABLED=true
      OIDC_CLIENT_SECRET: ""     # required if OIDC_ENABLED=true
      OIDC_REDIRECT_URI: ""      # required if OIDC_ENABLED=true (e.g. https://reddont.example.com/auth/oidc/callback)
      OIDC_SCOPE: "openid profile email"  # default: "openid profile email"
      OIDC_CLIENT_AUTH_METHOD: "client_secret_post"  # default: client_secret_post
      OIDC_AUTO_REGISTER: "true"          # default: true
      OIDC_FIRST_USER_ADMIN: "true"       # default: true (first ever user becomes admin)
      OIDC_ADMIN_CLAIM: "groups"          # default: groups (supports dotted paths like "realm_access.roles")
      OIDC_ADMIN_VALUE: "admin"           # default: admin
      OIDC_GROUP_CLAIM: "groups"          # default: groups (supports dotted paths / [index])
      OIDC_ALLOWED_GROUPS: ""             # optional; comma-separated list of groups required to log in / auto-register

    volumes:
      # reddont stores data in /data
      - ./reddont-data:/data
    ports:
      # If you change REDDONT_PORT, update the container port here too (HOST:CONTAINER).
      - "3000:3000"
    restart: unless-stopped