Self-host Tandoor Recipes with Docker Compose

Gestor de recetas autoalojado, pensado para colecciones grandes y un uso compartido granular.

tandoor-recipes

postgres

postgres:18.3-alpine3.23

postgres-postgres-data-init

busybox

postgres-postgres-socket-init

busybox

This is still a work in progress.

The generated compose file and instructions may not be complete or correct for every app yet. Please report any issues you encounter to contact@bitflake.com.

The steps below take a few minutes end to end.

Docker compose setup and file
save the generated compose and env files.
Secret generation
create the random passwords Tandoor Recipes needs.
Start Tandoor Recipes with Docker Compose
bring the stack up and check it's healthy.

Requirements

You'll need these installed on the machine you're deploying to:

Docker

Packages Tandoor Recipes and everything it depends on into an isolated container, so it runs the same way on your machine as it does everywhere else.

Install guide

Docker Compose

Reads docker-compose.ymland starts everything in it together. Ships with Docker Desktop. On Linux servers it's usually a separate install.

Install guide

1. Docker compose setup and file

Create a folder for Tandoor Recipes and save the file below into it as docker-compose.yml. It describes every container the stack needs — Tandoor Recipesitself and any supporting services, such as its database — along with the ports, volumes and environment variables each one uses. You'll also need an empty .env file in the same folder; Docker Compose reads it automatically and uses it to fill in the ${VARIABLE}references you'll see in the file below.

docker-compose.yml

version: "3.9"
services:
  postgres:
    image: postgres:18.3-alpine3.23
    restart: unless-stopped
    environment:
      PGDATA: /var/lib/postgresql/data
      POSTGRES_PASSWORD: ${RANDOM_PG_PASSWORD}
      POSTGRES_USER: app
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - postgres-socket:/var/run/postgresql
    depends_on:
      postgres-postgres-data-init:
        condition: service_completed_successfully
      postgres-postgres-socket-init:
        condition: service_completed_successfully
  postgres-postgres-data-init:
    image: busybox
    volumes:
      - postgres-data:/var/lib/postgresql/data
    command:
      - chown
      - 70:70
      - /var/lib/postgresql/data
  postgres-postgres-socket-init:
    image: busybox
    volumes:
      - postgres-socket:/var/run/postgresql
    command:
      - chown
      - 70:70
      - /var/run/postgresql
  tandoor-recipes:
    image: vabene1111/recipes:latest
    restart: unless-stopped
    ports:
      - 80:80
    environment:
      ALLOWED_HOSTS: tandoor-recipes.localhost
      CSRF_TRUSTED_ORIGINS: http://tandoor-recipes.localhost:80
      DB_ENGINE: django.db.backends.postgresql
      POSTGRES_DB: app
      POSTGRES_HOST: postgres
      POSTGRES_PASSWORD: ${RANDOM_PG_PASSWORD}
      POSTGRES_PORT: "5432"
      POSTGRES_USER: app
      SECRET_KEY: ${RANDOM_SECRET_KEY}
      TZ: UTC
    volumes:
      - mediafiles:/opt/recipes/mediafiles
      - staticfiles:/opt/recipes/staticfiles
      - tmp:/tmp
      - http-d:/opt/recipes/http.d
    configs:
      - source: tandoor-recipes-Recipes.conf.template
        target: /opt/recipes/http.d/Recipes.conf.template
    depends_on:
      postgres:
        condition: service_started
volumes:
  http-d: null
  mediafiles: null
  postgres-data: null
  postgres-socket: null
  staticfiles: null
  tmp: null
configs:
  tandoor-recipes-Recipes.conf.template:
    content: |
      proxy_temp_path /tmp/proxy_temp;
      client_body_temp_path /tmp/client_temp;
      fastcgi_temp_path /tmp/fastcgi_temp;
      uwsgi_temp_path /tmp/uwsgi_temp;
      scgi_temp_path /tmp/scgi_temp;

      server {
        listen $${TANDOOR_PORT};
        server_name localhost;

        client_max_body_size 512M;

        # serve media files
        location /media {
          alias $${MEDIA_ROOT};
          add_header Content-Disposition 'attachment; filename="$$args"';
        }

        # serve service worker under main path
        location = /service-worker.js {
          alias $${STATIC_ROOT}/vue3/service-worker.js;
        }

        # pass requests for dynamic content to gunicorn
        location / {
          proxy_set_header Host $$http_host;
          proxy_pass http://unix:/tmp/tandoor.sock;

          # param needed by django allauth sessions to log IP
          proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
        }

        location /errors/ {
          alias /etc/nginx/http.d/errorpages/;
          internal;
        }
      }

Volumes

Tandoor Recipes stores its data in named Docker volumes, so it survives container restarts and updates:

mediafiles mounted at /opt/recipes/mediafiles: Uploaded recipe images and other user-supplied media files served by Tandoor.
staticfiles mounted at /opt/recipes/staticfiles: Destination for Tandoor's collected static assets (CSS, JS, the Vue service worker), regenerated from bundled sources by collectstatic on each startup.
tmp mounted at /tmp: gunicorn's unix socket (/tmp/tandoor.sock, the nginx-to-gunicorn bridge from the Recipes.conf.template above) and nginx's own temp dirs. Under the platform's read-only-root-filesystem hardening this must be a writable volume, or gunicorn fails to bind the socket with "Read-only file system" and the pod crash-loops on the startup probe.
http-d mounted at /opt/recipes/http.d: boot.sh runs `envsubst < Recipes.conf.template > Recipes.conf` in this directory on every boot -- under the read-only-root-filesystem hardening that write fails silently (no `set -e`), leaving no Recipes.conf and no nginx vhost at all, so nginx starts but binds no port and the startup probe gets connection refused. Seeded (not plain ephemeral) so the image's baked `errorpages/` subdir -- referenced by the Recipes.conf.template below via /etc/nginx/http.d, a symlink to this same path -- survives alongside the writable Recipes.conf output.

2. Secret generation

Tandoor Recipes needs a few randomly generated secrets — for example, database passwords or an internal session key — before it can start. These are referenced from docker-compose.ymlabove but don't live in it, so they need to end up in your .env file. Pick one of the two options below.

Generating secrets…

3. Start Tandoor Recipes with Docker Compose

From the folder with docker-compose.yml and .env, run:

Terminal

Start Tandoor Recipes and all its supporting services in the background.

docker compose up -d

The -d flag runs the stack in the background so it keeps running after you close the terminal. Docker will pull the images the first time, which can take a minute or two.

To check on it afterwards: docker compose ps shows whether containers are healthy, and docker compose logs -f follows their logs if something looks wrong. Once it's running, open http://localhost:80 in your browser.