working settings for 100% Docker on AWS EC2, Nginx, AWS S3, AWS SES - SMTP, Azure AD auth

[scott-dunt]

a bit of hacking but got a working environment in AWS running from 100% docker-compose.yml environment.

1st docker-compose.yml

version: "3"
services:
  redis:
    image: redis
    networks:
      - outline

  postgres:
    image: postgres
    environment:
      POSTGRES_USER: <UserName>
      POSTGRES_PASSWORD: <UserPassword>
      POSTGRES_DB: outline
    volumes:
      - outline-db-data:/var/lib/postgresql/data
    networks:
      - outline

  outline:
    image:  outlinewiki/outline
# an absolute path here seems to work better with some versions of docker  
    env_file: /home/ec2-user/outline-wiki/outline.env

#   Un comment the next line to initialize the DB on 1st run.
#   command : sh -c "sleep 5 && yarn sequelize:migrate --env=production-ssl-disabled"
#   Run docker-compose up -d, the outline container will terminate but redis and postgres will still be running
#   Edit this file again, Comment out the 'command : sh ....'  line  and save the file. 
#  Run docker-compose up -d again to restart the outline container in 'production' mode

    ports:
      - "3000:3000"
    depends_on:
      - postgres
      - redis
    networks:
      - outline
  
networks:
  outline:
        
volumes:
  outline-db-data:

env file for Outline, named outline.env in my implementation:

# 👋 Welcome, we're glad you're setting up an installation of Outline. Copy this 
# file to .env or set the variables in your local environment manually. For 
# development with docker this should mostly work out  of the box other than 
# setting the Slack keys and the SECRET_KEY.

# –––––––––––––––– REQUIRED ––––––––––––––––

# Generate a hex-encoded 32-byte random key. You should use `openssl rand -hex 32`
# in your terminal to generate a random value.
SECRET_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Generate a unique random key. The format is not important but you could still use 
# `openssl rand -hex 32` in your terminal to produce this.
UTILS_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# For production point these at your databases, in development the default
# should work out of the box.

#For docker compose environment, the 'host' names for postgres and redis are
# the CONTAINER names you specified in the docker-compose.yml
DATABASE_URL=postgres:// <UserName>: <UserPassword>@postgres:5432/outline
DATABASE_URL_TEST=postgres:// <UserName>: <UserPassword>@postgres:5432/outline-test

# Uncomment this to disable SSL for connecting to Postgres
PGSSLMODE=disable
#for Docker-compose environment the redis 'host' name is the docker container name
REDIS_URL=redis://redis:6379

# URL should point to the fully qualified, publicly accessible URL. If using a
# proxy the port in URL and PORT may be different.
URL=https://outline.XXXXXXX.com
PORT=3000

# To support uploading of images for avatars and document attachments an
# s3-compatible storage must be provided. AWS S3 is recommended for redundency
# however if you want to keep all file storage local an alternative such as 
# minio (https://github.com/minio/minio) can be used.

# A more detailed guide on setting up S3 is available here:
# => https://wiki.generaloutline.com/share/125de1cc-9ff6-424b-8415-0d58c809a40f

# It does not appear that Outline will work with AWS IAM Role assignments. so you need an access id and key:
AWS_ACCESS_KEY_ID=XXXXXXXXXXXXXXXXXXXXXX
AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXXXXXX
#I'm running in  AWS us-east-2 (ohio) region, adjust for your environment.
AWS_REGION=us-east-2
AWS_S3_UPLOAD_BUCKET_URL=https://s3.us-east-2.amazonaws.com
AWS_S3_UPLOAD_BUCKET_NAME=<Your Bucket>
AWS_S3_UPLOAD_MAX_SIZE=26214400
AWS_S3_FORCE_PATH_STYLE=true
AWS_S3_ACL=private


# –––––––––––––– AUTHENTICATION ––––––––––––––

# Third party signin credentials, at least ONE OF EITHER Google, Slack,
# or Microsoft is required for a working installation or you'll have no sign-in
# options.

# To configure Slack auth, you'll need to create an Application at
# => https://api.slack.com/apps
#
# When configuring the Client ID, add a redirect URL under "OAuth & Permissions":
# https://<URL>/auth/slack.callback
#called Client ID in Slack Admin screen
SLACK_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
#Called Client Secret in Slack Admin Screen
SLACK_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

# To configure Google auth, you'll need to create an OAuth Client ID at
# => https://console.cloud.google.com/apis/credentials
#
# When configuring the Client ID, add an Authorized redirect URI:
# https://<URL>/auth/google.callback
#GOOGLE_CLIENT_ID=
#GOOGLE_CLIENT_SECRET=

# To configure Microsoft/Azure auth, you'll need to create an OAuth Client. See 
# the guide for details on setting up your Azure App:
# => https://wiki.generaloutline.com/share/dfa77e56-d4d2-4b51-8ff8-84ea6608faa4
AZURE_CLIENT_ID=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AZURE_CLIENT_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AZURE_RESOURCE_APP_ID=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

# –––––––––––––––– OPTIONAL ––––––––––––––––

# If using a Cloudfront/Cloudflare distribution or similar it can be set below.
# This will cause paths to javascript, stylesheets, and images to be updated to  
# the hostname defined in CDN_URL. In your CDN configuration the origin server 
# should be set to the same as URL.
CDN_URL=

# Auto-redirect to https in production. The default is true but you may set to 
# false if you can be sure that SSL is terminated at an external loadbalancer.
FORCE_HTTPS=true

# Have the installation check for updates by sending anonymized statistics to
# the maintainers
ENABLE_UPDATES=true

# Override the maxium size of document imports, could be required if you have
# especially large Word documents with embedded imagery
MAXIMUM_IMPORT_SIZE=5120000

# You may enable or disable debugging categories to increase the noisiness of
# logs. The default is a good balance
#if you want nerd level logging, enable debug=*
#DEBUG=*
DEBUG=cache,presenters,events,emails,mailer,utils,http,server,services

# Comma separated list of domains to be allowed to signin to the wiki. If not
# set, all domains are allowed by default when using Google OAuth to signin
ALLOWED_DOMAINS=XXXXXXXXX.com

# For a complete Slack integration with search and posting to channels the 
# following configs are also needed, some more details
# => https://wiki.generaloutline.com/share/be25efd1-b3ef-4450-b8e5-c4a4fc11e02a
#
SLACK_VERIFICATION_TOKEN=XXXXXXXXXXXXXXXXXXXXXXXX
SLACK_APP_ID=XXXXXXXXXXXXXXXXXXXXX
SLACK_MESSAGE_ACTIONS=true

# Optionally enable google analytics to track pageviews in the knowledge base 
#GOOGLE_ANALYTICS_ID=

# Optionally enable Sentry (sentry.io) to track errors and performance
#SENTRY_DSN=

# To support sending outgoing transactional emails such as "document updated" or 
# "you've been invited" you'll need to provide authentication for an SMTP server
#These setting work in US-East-1 AWS SMTP - SES configuration. Make sure your AWS user has SES credentials:
# https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html
# per document https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-smtp-software-package.html
# AWS uses -  Port 587 for STARTTLS mode , or 465 to onnect using TLS Wrapper)
# Port 465 - TLS Wrapper works in my environment.

SMTP_HOST=email-smtp.us-east-1.amazonaws.com
SMTP_PORT=465
SMTP_USERNAME=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
SMTP_PASSWORD=XXXXXXXXXXXXXXXXXXXXXXXXXXX
SMTP_FROM_EMAIL=XXXXXXXXXXXXXXXXXXX
SMTP_REPLY_EMAIL=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
SMTP_TLS_CIPHERS=SSLv3
SMTP_SECURE=true

# Custom logo that displays on the authentication screen, scaled to height: 60px
# TEAM_LOGO=https://example.com/images/logo.png

# The default interface language. See translate.getoutline.com for a list of 
# available language codes and their rough percentage translated.
DEFAULT_LANGUAGE=en_US

The .env files for Docker are NOT Yaml.. do NOT quote any of the strings in this file, even if they contain special characters. Docker will read in and INCLUDE the "" in the variable. If you are unsure about whether a variable is getting set correctly. Once the outline container is up, you can use docker to start a shell INSIDE the running container and do an env command to see the variables.

1. run docker ps, find and copy the container ID # for the outline container.
2. run docker exec -it <container #> sh ; this will launch a shell inside the container
3. run an env command to display all the variables set INSIDE the container. you can also do a env | sort to sort them alphabetically

Finally Nginx conf file for this 'virtual site"

server {
    listen 80 ;
    server_name outline.xxxxx.com;

 listen 443 ssl; # managed by Certbot

    # RSA certificate
    ssl_certificate  /etc/letsencrypt/live/outline.XXXX.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/outline.XXXX.com/privkey.pem; # managed by Certbot
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;                                                         
    ssl_session_cache shared:SSL:1m;                                                                     
    ssl_prefer_server_ciphers   on;                                                                      
    ssl_stapling on;                                                                                     
    ssl_stapling_verify on;                                                                              
    chunked_transfer_encoding on;                                                                        
    client_max_body_size 0;

    # Redirect non-https traffic to https
    if ($scheme != "https") {
       return 301 https://$server_name$request_uri;
         }

# individual nginx logs 
access_log  /var/log/nginx/outline_access.log combined;
error_log /var/log/nginx/outline_error.log warn;

location / {
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header Host $host;
   proxy_set_header Host $http_host;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Scheme $scheme;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_redirect off;
    proxy_pass http://localhost:3000/;
  }

}

Foot notes:
IAM security policy I use for the user ID for S3 access

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<Bucket Name>"
            ]
        },
        {
            "Sid": "VisualEditor",
            "Effect": "Allow",
            "Action": [
                "s3:GetObjectAcl",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:GetObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::<Bucket Name>/*"
        }
    ]
}

S3 Buckets in AWS for use with outline need to have a 'CORS' policy, which is NOT the 'bucket security policy', added to them:

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "PUT",
            "POST"
        ],
        "AllowedOrigins": [
            "https://outline.XXXXX.com"
        ],
        "ExposeHeaders": []
    },
    {
        "AllowedHeaders": [],
        "AllowedMethods": [
            "GET"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": []
    }
]

[johnoscott]

Thanks for this. I was looking for a docker-compose solution as a quick way to get a local working version to check out Outline. It would be great if this could be included in the official docs.

[scott-dunt]

You're welcome.. Its FOSS so long as we all help out.. I'm not a coder.. But I can document a setup when I get it working, so that what I do.

[meepmeep]

Any idea on how to make outline listen to something else than localhost ?

There is no setting on outline.env to bind a specific ip / host, and my reverse proxy is on another server (so proxy_pass http://localhost:3000/ should look like http://ip.of.other.server:3000).