101 lines
3.4 KiB
YAML
101 lines
3.4 KiB
YAML
# Deploiement de production, derriere le Traefik existant.
|
|
# Aucun port n'est publie : le trafic entre par le tunnel Cloudflare puis Traefik.
|
|
#
|
|
# cp .env.example .env puis renseigner ENCLUME_TAG et ENCLUME_DOMAINE
|
|
# docker compose pull && docker compose up -d
|
|
#
|
|
# Retour arriere : remettre l'ancienne valeur de ENCLUME_TAG, puis up -d.
|
|
|
|
name: enclume
|
|
|
|
services:
|
|
web:
|
|
image: ${ENCLUME_REGISTRY:-harbor.tips-of-mine.com}/enclume/web:${ENCLUME_TAG:?definir ENCLUME_TAG dans .env}
|
|
restart: unless-stopped
|
|
environment:
|
|
ENCLUME_CATALOG: /catalogue
|
|
GUNICORN_WORKERS: ${GUNICORN_WORKERS:-2}
|
|
TZ: ${TZ:-Europe/Paris}
|
|
volumes:
|
|
- catalogue:/catalogue:ro
|
|
networks: [interne, traefik]
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=32m,mode=1777
|
|
security_opt: ["no-new-privileges:true"]
|
|
cap_drop: [ALL]
|
|
deploy:
|
|
resources:
|
|
limits: {cpus: "1.0", memory: 512M}
|
|
logging:
|
|
driver: json-file
|
|
options: {max-size: "10m", max-file: "3"}
|
|
labels:
|
|
traefik.enable: "true"
|
|
traefik.docker.network: traefik
|
|
traefik.http.routers.enclume.rule: Host(`${ENCLUME_DOMAINE:?definir ENCLUME_DOMAINE}`)
|
|
traefik.http.routers.enclume.entrypoints: websecure
|
|
traefik.http.routers.enclume.tls.certresolver: ${TRAEFIK_RESOLVER:-cloudflare}
|
|
traefik.http.routers.enclume.middlewares: enclume-entetes,enclume-limite
|
|
traefik.http.services.enclume.loadbalancer.server.port: "8080"
|
|
traefik.http.middlewares.enclume-entetes.headers.stsSeconds: "31536000"
|
|
traefik.http.middlewares.enclume-entetes.headers.stsIncludeSubdomains: "true"
|
|
traefik.http.middlewares.enclume-entetes.headers.frameDeny: "true"
|
|
traefik.http.middlewares.enclume-entetes.headers.contentTypeNosniff: "true"
|
|
traefik.http.middlewares.enclume-limite.ratelimit.average: "60"
|
|
traefik.http.middlewares.enclume-limite.ratelimit.burst: "120"
|
|
|
|
catalog-sync:
|
|
image: ${ENCLUME_REGISTRY:-harbor.tips-of-mine.com}/enclume/catalog-sync:${ENCLUME_TAG:?definir ENCLUME_TAG dans .env}
|
|
restart: unless-stopped
|
|
environment:
|
|
CATALOG_REPO: ${CATALOG_REPO:-}
|
|
CATALOG_BRANCH: ${CATALOG_BRANCH:-main}
|
|
CATALOG_SUBDIR: ${CATALOG_SUBDIR:-catalog}
|
|
CATALOG_DEST: /catalogue
|
|
SYNC_INTERVAL: ${SYNC_INTERVAL:-300}
|
|
RELOAD_URL: http://web:8080/recharger
|
|
volumes:
|
|
- catalogue:/catalogue
|
|
networks: [interne]
|
|
security_opt: ["no-new-privileges:true"]
|
|
deploy:
|
|
resources:
|
|
limits: {cpus: "0.25", memory: 128M}
|
|
logging:
|
|
driver: json-file
|
|
options: {max-size: "5m", max-file: "2"}
|
|
|
|
# Utilisee a partir du chantier 2 (liens de partage, projets enregistres).
|
|
# L'application fonctionne sans, tant que ENCLUME_DATABASE_URL n'est pas defini.
|
|
db:
|
|
image: postgres:16.4-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: enclume
|
|
POSTGRES_USER: enclume
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?definir POSTGRES_PASSWORD}
|
|
TZ: ${TZ:-Europe/Paris}
|
|
volumes:
|
|
- donnees:/var/lib/postgresql/data
|
|
networks: [interne]
|
|
security_opt: ["no-new-privileges:true"]
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U enclume -d enclume"]
|
|
interval: 20s
|
|
timeout: 5s
|
|
retries: 5
|
|
deploy:
|
|
resources:
|
|
limits: {cpus: "1.0", memory: 512M}
|
|
|
|
volumes:
|
|
catalogue:
|
|
donnees:
|
|
|
|
networks:
|
|
interne:
|
|
internal: true
|
|
traefik:
|
|
external: true
|