Configuration

.env.example covers the short list most installs touch (admin credentials, MaxMind key, log paths, DB password). For every environment variable and its default, see docs/configuration.md.

Set GEOMETRIKKS_ENV_FILE to load a different .env path, or to an empty value to disable dotenv loading and configure through real environment variables only.

PUID and PGID

The container starts as root only long enough to re-map its internal user to PUID:PGID (default 1000:1000), fix ownership of /app/logs and the GeoIP volume, and drop privileges. The app process never runs as root. Set PUID/PGID in .env to the user that should own ./logs on the host (usually your own: id -u / id -g).

In an environment that forbids root entirely (rootless Docker, hardened setups), set a user: on the app service in the compose file; the entrypoint detects it, skips the re-mapping, and runs the app as that user. You then manage ./logs ownership yourself.

To harden further with PUID/PGID re-mapping:

  app:
    # ...
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID

Or with a user: override, where the image needs no capabilities at all:

  app:
    # ...
    user: "1000:1000"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL