David Schroeder
91 lines
2.4 KiB
YAML
91 lines
2.4 KiB
YAML
name: tapm
|
|
|
|
services:
|
|
broker:
|
|
container_name: tapm-broker
|
|
build: .
|
|
image: tai/tapm-deployment-broker:local
|
|
env_file:
|
|
- path: .env
|
|
required: false
|
|
restart: unless-stopped
|
|
init: true
|
|
read_only: true
|
|
networks:
|
|
- edge
|
|
volumes:
|
|
- ./config/broker:/data
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
tmpfs:
|
|
- /tmp:size=16m,mode=1777
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8080/health/ready"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
|
|
gitea:
|
|
container_name: tapm-gitea
|
|
image: docker.gitea.com/gitea:1.26.4-rootless
|
|
restart: unless-stopped
|
|
networks:
|
|
- edge
|
|
volumes:
|
|
- ./config/gitea/data:/var/lib/gitea
|
|
- ./config/gitea/config:/etc/gitea
|
|
environment:
|
|
GITEA__database__DB_TYPE: sqlite3
|
|
GITEA__database__PATH: /var/lib/gitea/data/gitea.db
|
|
GITEA__server__DOMAIN: ${GITEA_DOMAIN}
|
|
GITEA__server__ROOT_URL: https://${GITEA_DOMAIN}/
|
|
GITEA__server__HTTP_ADDR: 0.0.0.0
|
|
GITEA__server__HTTP_PORT: "3000"
|
|
GITEA__server__DISABLE_SSH: "true"
|
|
GITEA__session__COOKIE_SECURE: "true"
|
|
GITEA__service__DISABLE_REGISTRATION: "true"
|
|
GITEA__security__INSTALL_LOCK: "true"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:3000/api/healthz"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
|
|
nginx:
|
|
container_name: tapm-nginx
|
|
image: nginx:1.28-alpine
|
|
restart: unless-stopped
|
|
networks:
|
|
- edge
|
|
ports:
|
|
- "${HTTP_PORT:-8680}:80"
|
|
- "${HTTPS_PORT:-8643}:443"
|
|
volumes:
|
|
- ./deploy/nginx/templates/bootstrap.conf.template:/etc/nginx/templates/default.conf.template:ro
|
|
- ./config/certbot-webroot:/var/www/certbot:ro
|
|
environment:
|
|
BROKER_DOMAIN: ${BROKER_DOMAIN}
|
|
GITEA_DOMAIN: ${GITEA_DOMAIN}
|
|
SSL_CERTIFICATE_FILE: ${SSL_CERTIFICATE_FILE:-fullchain.pem}
|
|
SSL_CERTIFICATE_KEY_FILE: ${SSL_CERTIFICATE_KEY_FILE:-privkey.pem}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
certbot:
|
|
image: certbot/certbot:v5.7.0
|
|
profiles: ["tools"]
|
|
volumes:
|
|
- ./config/letsencrypt:/etc/letsencrypt
|
|
- ./config/certbot-webroot:/var/www/certbot
|
|
|
|
networks:
|
|
edge:
|
|
external: true
|
|
name: tapm-edge
|