Update docker-compose.yml

2026-08-01 11:08:55 +02:00
1 parent 960a643342
commit 73f193bc9b
@@ -1,42 +1,84 @@
-#### NETWORKS
+---
+# OpenBao — gestion de secrets (fork MPL-2.0 de HashiCorp Vault)
+# Hôte : SLDOKP03 — /opt/openbao
+# Exposition : openbao.tips-of-mine.com via Traefik (tunnel Cloudflare)
+
+services:
+  openbao-app:
+    image: openbao/openbao:${OPENBAO_VERSION}
+    container_name: openbao-app
+    restart: unless-stopped
+
+#    command: ["server", "-config=/openbao/config/openbao.hcl"]
+    command: ["server"]
+
+    # Le conteneur tourne directement sous l'utilisateur openbao : l'entrypoint
+    # saute alors sa phase root (chown + su-exec), ce qui permet de garder
+    # cap_drop ALL. Valeurs à reprendre de ton installation précédente.
+    user: "${OPENBAO_UID}:${OPENBAO_GID}"
+
+    # Pas de `command:` — l'entrypoint ajoute déjà -config=/openbao/config.
+    # Le préciser ici provoquait l'avertissement « duplicate configuration ».
+
+    environment:
+      - TZ=Europe/Paris
+      # Pour que `docker exec openbao-app bao ...` fonctionne sans -address
+      - BAO_ADDR=http://127.0.0.1:8200
+
+    volumes:
+      - ./config:/openbao/config:ro     # openbao.hcl
+      - ./data:/openbao/data            # storage raft (bolt) — chown 100:1000
+      - ./logs:/openbao/logs            # audit device (activé plus tard)
+
+    networks:
+      - traefik_front_network
+      - back_network_openbao
+
+    # Durcissement : raft/bolt mmap la base, on désactive mlock côté HCL,
+    # donc aucune capability n'est nécessaire.
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+
+    healthcheck:
+      # `bao status` : 0 = descellé, 2 = scellé (état normal après reboot),
+      # 1 = erreur réelle. On accepte 0 et 2.
+      test: ["CMD-SHELL", "bao status >/dev/null 2>&1; s=$$?; [ $$s -eq 0 ] || [ $$s -eq 2 ]"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+    labels:
+      # --- Traefik -------------------------------------------------------
+      - traefik.enable=true
+      - traefik.docker.network=traefik_front_network
+      - traefik.http.routers.openbao-https.rule=Host(`openbao.${DOMAIN}`)
+      - traefik.http.routers.openbao-https.entrypoints=https
+      - traefik.http.routers.openbao-https.tls=true
+      - traefik.http.routers.openbao-https.service=openbao
+      - traefik.http.services.openbao.loadbalancer.server.port=8200
+      # --- Homepage ------------------------------------------------------
+      - homepage.group=Security
+      - homepage.name=OpenBao
+      - homepage.icon=openbao.png
+      - homepage.href=https://openbao.${DOMAIN}
+      - homepage.description=Gestion de secrets (fork Vault)
+      # --- Watchtower ----------------------------------------------------
+      # VOLONTAIREMENT ABSENT : une mise à jour = un redémarrage = coffre
+      # rescellé, donc indisponible jusqu'à saisie manuelle des clés Shamir.
+      # Les montées de version d'OpenBao se font à la main.
+      - com.centurylinklabs.watchtower.enable=false
+
 networks:
  traefik_front_network:
    external: true
-  back_network_:
+  back_network_openbao:
    driver: bridge
-    attachable: true
-
-#### SERVICES
-services:
-### hello_world
-  hello_world:
-    container_name: gitea-app
-    hostname: gitea-app
-    image: hello-world
-    environment:
-    restart: always
-    networks:
-#      - back_network_gitea
-      - traefik_front_network
-    volumes:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=traefik_front_network"
-# HTTP
-      - "traefik.http.routers.hello-world-http.rule=Host(`hello-world.tips-of-mine.com`)"
-      - "traefik.http.routers.hello-world-http.entrypoints=http"
-      - "traefik.http.routers.hello-world-http.priority=49"
-# HTTPS
-      - "traefik.http.routers.hello-world-https.rule=Host(`hello-world.tips-of-mine.com`)"
-      - "traefik.http.routers.hello-world-https.entrypoints=https"
-      - "traefik.http.routers.hello-world-https.tls=true"
-      - "traefik.http.routers.hello-world-https.priority=50"
-      - "traefik.http.routers.gitea.service=gitea-https-service"
-# Middleware
-# Service
-#      - "traefik.http.services.gitea-https-service.loadbalancer.server.port=3000"
-#      - "traefik.http.services.gitea-https-service.loadbalancer.server.scheme=https"
-#      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.hostname=gitea.traefik.me"
-#      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.method=foobar"
-#      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.timeout=10"
-#      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.interval=30"