Enclume : editeur CLAPI, catalogue de 26 packs, empaquetage Docker

compose.yaml

@@ -0,0 +1,100 @@
+# Deploiement de production, derriere le Traefik existant.
+# Aucun port n'est publie : le trafic entre par le tunnel Cloudflare puis Traefik.
+#
+#   cp .env.example .env   puis renseigner ENCLUME_TAG et ENCLUME_DOMAINE
+#   docker compose pull && docker compose up -d
+#
+# Retour arriere : remettre l'ancienne valeur de ENCLUME_TAG, puis up -d.
+
+name: enclume
+
+services:
+  web:
+    image: ${ENCLUME_REGISTRY:-harbor.tips-of-mine.com}/enclume/web:${ENCLUME_TAG:?definir ENCLUME_TAG dans .env}
+    restart: unless-stopped
+    environment:
+      ENCLUME_CATALOG: /catalogue
+      GUNICORN_WORKERS: ${GUNICORN_WORKERS:-2}
+      TZ: ${TZ:-Europe/Paris}
+    volumes:
+      - catalogue:/catalogue:ro
+    networks: [interne, traefik]
+    read_only: true
+    tmpfs:
+      - /tmp:size=32m,mode=1777
+    security_opt: ["no-new-privileges:true"]
+    cap_drop: [ALL]
+    deploy:
+      resources:
+        limits: {cpus: "1.0", memory: 512M}
+    logging:
+      driver: json-file
+      options: {max-size: "10m", max-file: "3"}
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: traefik
+      traefik.http.routers.enclume.rule: Host(`${ENCLUME_DOMAINE:?definir ENCLUME_DOMAINE}`)
+      traefik.http.routers.enclume.entrypoints: websecure
+      traefik.http.routers.enclume.tls.certresolver: ${TRAEFIK_RESOLVER:-cloudflare}
+      traefik.http.routers.enclume.middlewares: enclume-entetes,enclume-limite
+      traefik.http.services.enclume.loadbalancer.server.port: "8080"
+      traefik.http.middlewares.enclume-entetes.headers.stsSeconds: "31536000"
+      traefik.http.middlewares.enclume-entetes.headers.stsIncludeSubdomains: "true"
+      traefik.http.middlewares.enclume-entetes.headers.frameDeny: "true"
+      traefik.http.middlewares.enclume-entetes.headers.contentTypeNosniff: "true"
+      traefik.http.middlewares.enclume-limite.ratelimit.average: "60"
+      traefik.http.middlewares.enclume-limite.ratelimit.burst: "120"
+
+  catalog-sync:
+    image: ${ENCLUME_REGISTRY:-harbor.tips-of-mine.com}/enclume/catalog-sync:${ENCLUME_TAG:?definir ENCLUME_TAG dans .env}
+    restart: unless-stopped
+    environment:
+      CATALOG_REPO: ${CATALOG_REPO:-}
+      CATALOG_BRANCH: ${CATALOG_BRANCH:-main}
+      CATALOG_SUBDIR: ${CATALOG_SUBDIR:-catalog}
+      CATALOG_DEST: /catalogue
+      SYNC_INTERVAL: ${SYNC_INTERVAL:-300}
+      RELOAD_URL: http://web:8080/recharger
+    volumes:
+      - catalogue:/catalogue
+    networks: [interne]
+    security_opt: ["no-new-privileges:true"]
+    deploy:
+      resources:
+        limits: {cpus: "0.25", memory: 128M}
+    logging:
+      driver: json-file
+      options: {max-size: "5m", max-file: "2"}
+
+  # Utilisee a partir du chantier 2 (liens de partage, projets enregistres).
+  # L'application fonctionne sans, tant que ENCLUME_DATABASE_URL n'est pas defini.
+  db:
+    image: postgres:16.4-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: enclume
+      POSTGRES_USER: enclume
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?definir POSTGRES_PASSWORD}
+      TZ: ${TZ:-Europe/Paris}
+    volumes:
+      - donnees:/var/lib/postgresql/data
+    networks: [interne]
+    security_opt: ["no-new-privileges:true"]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U enclume -d enclume"]
+      interval: 20s
+      timeout: 5s
+      retries: 5
+    deploy:
+      resources:
+        limits: {cpus: "1.0", memory: 512M}
+
+volumes:
+  catalogue:
+  donnees:
+
+networks:
+  interne:
+    internal: true
+  traefik:
+    external: true