Admin
0aa4cb1410
- Pin seaweedfs (4.47), jaeger (1.76.0), certbot (v5.8.0) and pgadmin (9.18) instead of :latest. - Rotate container logs (json-file, 3 x 10 MB) in every stack. - Cap Jaeger's in-memory storage at 100k traces and add a healthcheck. - Publish dev ports on 127.0.0.1 (DEV_BIND_ADDRESS) so the dev credentials aren't reachable from the LAN. - Fix the prod command in compose.yml's header, the README's note on who writes the admin PAT, and the certbot command's line breaks.
62 lines
1.7 KiB
YAML
62 lines
1.7 KiB
YAML
# Shared public edge: the only thing that publishes host ports 80/443. One
|
|
# nginx terminates TLS for every project's domains (Gitea, Musify, ...) and
|
|
# proxies to their containers by name, over the networks below. Certificates
|
|
# come from Let's Encrypt (webroot), renewed by the certbot service.
|
|
#
|
|
# docker compose -f edge/compose.yml up -d
|
|
#
|
|
# Requires `infra-net` (created by ../compose.yml) and `gitea_gitea` (created
|
|
# by the Gitea stack) to already exist.
|
|
|
|
name: edge
|
|
|
|
# Docker's default json-file driver never rotates, so logs would grow until
|
|
# the disk fills up.
|
|
x-logging: &default-logging
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
networks:
|
|
infra-net:
|
|
name: infra-net
|
|
external: true
|
|
gitea:
|
|
name: gitea_gitea
|
|
external: true
|
|
|
|
services:
|
|
nginx:
|
|
image: nginx:1.27-alpine
|
|
container_name: edge-nginx
|
|
# The subshell reloads nginx every 6h so renewed certificates get picked up.
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "(while :; do sleep 6h; nginx -s reload; done) & exec nginx -g 'daemon off;'"
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./conf.d:/etc/nginx/conf.d:ro
|
|
- ./snippets:/etc/nginx/snippets:ro
|
|
- ./certbot/www:/var/www/certbot:ro
|
|
- ./certbot/conf:/etc/letsencrypt:ro
|
|
networks: [gitea, infra-net]
|
|
logging: *default-logging
|
|
restart: unless-stopped
|
|
|
|
certbot:
|
|
image: certbot/certbot:v5.8.0
|
|
container_name: edge-certbot
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -c
|
|
- "trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot --quiet; sleep 12h & wait $${!}; done"
|
|
volumes:
|
|
- ./certbot/conf:/etc/letsencrypt
|
|
- ./certbot/www:/var/www/certbot
|
|
logging: *default-logging
|
|
restart: unless-stopped
|