From a43e0924eb28a7f16b28581b90f756a5e7ce0424 Mon Sep 17 00:00:00 2001
From: admin <admin@bryanmail.net>
Date: Mon, 22 Jun 2026 22:41:58 -0700
Subject: [PATCH] Remove env_file from meshcentral - inline non-secrets,
 BACKUPS_PW sourced from host .env at deploy time

---
 meshcentral.yaml | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 meshcentral.yaml

diff --git a/meshcentral.yaml b/meshcentral.yaml
new file mode 100644
index 0000000..c0df792
--- /dev/null
+++ b/meshcentral.yaml
@@ -0,0 +1,37 @@
+version: '3'
+services:
+  meshcentral:
+    image: typhonragewind/meshcentral:latest
+    networks:
+      - traefik_backend
+    ports:
+      - 8086:443
+    environment:
+      - HOSTNAME=assist.bryanmail.net
+      - REVERSE_PROXY=10.0.0.0/8
+      - REVERSE_PROXY_TLS_PORT=443
+      - IFRAME=false    #set to true if you wish to enable iframe support
+      - ALLOW_NEW_ACCOUNTS=false    #set to false if you want disable self-service creation of new accounts besides the first (admin)
+      - WEBRTC=false  #set to true to enable WebRTC - per documentation it is not officially released with meshcentral, but is solid enough to work with. Use with caution
+      - BACKUPS_PW=${BACKUPS_PW} #password for the autobackup function
+      - BACKUP_INTERVAL=24 # Interval in hours for the autobackup function
+      - BACKUP_KEEP_DAYS=10 #number of days of backups the function keeps
+    volumes:
+      - /volume1/docker/meshcentral/data:/opt/meshcentral/meshcentral-data    #config.json and other important files live here. A must for data persistence
+      - /volume1/docker/meshcentral/user_files:/opt/meshcentral/meshcentral-files    #where file uploads for users live
+      - /volume1/docker/meshcentral/backups:/opt/meshcentral/meshcentral-backups     #Backups location
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.meshcentral.rule=Host(`assist.bryanmail.net`)
+        - traefik.http.routers.meshcentral.tls=true
+        - traefik.http.routers.meshcentral.tls.certresolver=letsencrypt
+        - traefik.http.routers.meshcentral.entrypoints=websecure
+        - traefik.http.services.meshcentral.loadbalancer.server.port=443
+        - traefik.http.routers.meshcentral.middlewares=crowdsec@file
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.services.meshcentral.loadbalancer.server.scheme=http
+
+networks:
+    traefik_backend:
+       external: true