panel — open-source game server manager (public release)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14 19:19:43 -07:00
commit 658bda1d24
2160 changed files with 300413 additions and 0 deletions
@@ -0,0 +1,90 @@
+# Panel — PRODUCTION single-box compose (postgres + controller + agent).
+# (Dev Postgres-only compose lives at ../docker-compose.dev.yml.)
+#
+# Usage, from the repo root:
+#   cp deploy/.env.example deploy/.env   # then edit deploy/.env
+#   docker compose -f deploy/docker-compose.yml --env-file deploy/.env up -d --build
+#
+# First run: watch `docker compose logs controller` for the ADMIN BOOTSTRAP
+# banner (generated admin password), then create a pair token in the UI
+# (or via POST /api/admin/pair-tokens) — the agent pairs itself on start
+# only if you exec the pairing step; see README / install.sh for the flow.
+
+services:
+  postgres:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: panel
+      POSTGRES_PASSWORD: ${PANEL_DB_PASSWORD:?set PANEL_DB_PASSWORD in deploy/.env}
+      POSTGRES_DB: panel
+    volumes:
+      - panel_pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U panel -d panel"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  controller:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.controller
+      args:
+        VERSION: ${PANEL_VERSION:-dev}
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      PANEL_DB_URL: postgres://panel:${PANEL_DB_PASSWORD}@postgres:5432/panel?sslmode=disable
+      # Optional: stable first-boot admin password instead of a generated one.
+      PANEL_ADMIN_PASSWORD: ${PANEL_ADMIN_PASSWORD:-}
+    ports:
+      - "${PANEL_HTTP_PORT:-8080}:8080"   # dashboard + REST API
+      - "${PANEL_GRPC_PORT:-8443}:8443"   # agent gRPC (mTLS)
+    volumes:
+      - panel_controller_data:/opt/panel/data
+
+  agent:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.agent
+      args:
+        VERSION: ${PANEL_VERSION:-dev}
+    restart: unless-stopped
+    depends_on:
+      - controller
+    # ┌────────────────────────────── SECURITY ──────────────────────────────┐
+    # │ The agent mounts the HOST Docker socket to create and manage game-   │
+    # │ server containers. Docker-socket access is ROOT-EQUIVALENT on the    │
+    # │ host: anyone who can reach this container's filesystem or process    │
+    # │ can own the machine. Run this stack only on a host you fully trust,  │
+    # │ keep the panel dashboard behind auth/TLS, and never re-export the    │
+    # │ socket from this container.                                          │
+    # └───────────────────────────────────────────────────────────────────────┘
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      # IMPORTANT: the agent passes instance paths to the HOST docker daemon
+      # as bind mounts, so the host path and in-container path MUST match.
+      # Keep both sides of this mapping identical.
+      - ${PANEL_AGENT_DATA:-/opt/panel/data}:${PANEL_AGENT_DATA:-/opt/panel/data}
+    environment:
+      PANEL_GRPC_PORT: "8443"
+    command:
+      - "--controller"
+      - "controller:8443"
+      - "--modules-dir"
+      - "./modules"
+      - "--data-root"
+      - "${PANEL_AGENT_DATA:-/opt/panel/data}/instances"
+      - "--meta-dir"
+      - "${PANEL_AGENT_DATA:-/opt/panel/data}/instance-meta"
+      - "--backup-dir"
+      - "${PANEL_AGENT_DATA:-/opt/panel/data}/backups"
+      - "--cert-dir"
+      - "${PANEL_AGENT_DATA:-/opt/panel/data}/certs"
+
+volumes:
+  panel_pgdata:
+  panel_controller_data: