61 lines
2.0 KiB
YAML
61 lines
2.0 KiB
YAML
# Pull-only production job: no source checkout, build, or searches.toml host bind.
|
|
# Searches and application code come from the same digest-pinned image.
|
|
name: car-tracker-app
|
|
|
|
services:
|
|
app:
|
|
image: "${CAR_TRACKER_IMAGE:?Set a digest-pinned image}"
|
|
restart: "no"
|
|
init: true
|
|
stop_grace_period: 30s
|
|
user: "${APP_UID:-1000}:${APP_GID:-1000}"
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cpus: 1.5
|
|
mem_limit: 2g
|
|
pids_limit: 256
|
|
shm_size: 512m
|
|
tmpfs:
|
|
- /tmp:rw,nosuid,nodev,size=512m,mode=1777
|
|
- /tmp/.X11-unix:rw,nosuid,nodev,size=1m,mode=1777
|
|
environment:
|
|
PGHOST: "${PGHOST:?Set the existing PostgreSQL hostname or IP}"
|
|
PGPORT: "${PGPORT:-5432}"
|
|
PGDATABASE: "${PGDATABASE:?Set the application database name}"
|
|
PGUSER: "${PGUSER:?Set the application database role}"
|
|
PGSSLMODE: "${PGSSLMODE:-require}"
|
|
PGPASSFILE: /run/db/pgpass
|
|
PGSSLROOTCERT: /run/db/root.crt
|
|
# Host-owned collection policy. The restricted SSH wrapper validates these
|
|
# and builds a fixed argv; all omits the corresponding CLI limit/filter.
|
|
COLLECT_FAMILY: "${COLLECT_FAMILY:-saab-900}"
|
|
COLLECT_MAX_PAGES: "${COLLECT_MAX_PAGES:-1}"
|
|
COLLECT_MAX_DETAILS: "${COLLECT_MAX_DETAILS:-1}"
|
|
COLLECT_DELAY: "${COLLECT_DELAY:-5}"
|
|
COLLECT_DETAIL_POLICY: "${COLLECT_DETAIL_POLICY:-always}"
|
|
COLLECT_DETAIL_REFRESH_DAYS: "${COLLECT_DETAIL_REFRESH_DAYS:-7}"
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
volumes:
|
|
- type: bind
|
|
source: "${RAW_DATA_DIR:?Set an existing private raw storage directory}"
|
|
target: /data
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${DB_CONFIG_DIR:?Set an existing private DB configuration directory}"
|
|
target: /run/db
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
networks:
|
|
app:
|
|
|
|
networks:
|
|
app:
|
|
ipam:
|
|
config:
|
|
- subnet: "${APP_SUBNET:-172.30.17.0/28}"
|