Publish DevRunbook source

2026-09-03 04:09:17 +02:00
commit cfd2804e27
928 changed files with 161642 additions and 0 deletions
@@ -0,0 +1,128 @@
+name: devrunbook
+
+x-app-environment: &app-environment
+  DATABASE_URL: postgresql://devrunbook:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD to a URL-safe random value}@postgres:5432/devrunbook
+  PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:?Set PUBLIC_BASE_URL to the exact externally visible URL}
+  SESSION_SECRET: ${SESSION_SECRET:?Set SESSION_SECRET to at least 32 random bytes}
+  INTEGRATION_ENCRYPTION_KEY: ${INTEGRATION_ENCRYPTION_KEY:?Set INTEGRATION_ENCRYPTION_KEY to a base64-encoded 32-byte key}
+  INTEGRATION_ENCRYPTION_KEY_VERSION: ${INTEGRATION_ENCRYPTION_KEY_VERSION:-v1}
+  INTEGRATION_ENCRYPTION_OLD_KEYS: '${INTEGRATION_ENCRYPTION_OLD_KEYS:-{}}'
+  CONTENT_ROOT: /content
+  ARTIFACT_ROOT: /artifacts
+  BOOTSTRAP_TOKEN: ${BOOTSTRAP_TOKEN:?Set BOOTSTRAP_TOKEN to a random first-run token}
+  REGISTRATION_MODE: ${REGISTRATION_MODE:-closed}
+  TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-}
+  MAINTENANCE_MODE: ${MAINTENANCE_MODE:-false}
+  MAX_IMPORT_BYTES: ${MAX_IMPORT_BYTES:-10485760}
+  MAX_EXPANDED_ARCHIVE_BYTES: ${MAX_EXPANDED_ARCHIVE_BYTES:-52428800}
+  MAX_ARCHIVE_FILES: ${MAX_ARCHIVE_FILES:-500}
+  MAX_SINGLE_FILE_BYTES: ${MAX_SINGLE_FILE_BYTES:-5242880}
+  MAX_PROMPT_BYTES: ${MAX_PROMPT_BYTES:-2097152}
+  MAX_EVIDENCE_BYTES: ${MAX_EVIDENCE_BYTES:-262144}
+  MAX_ARTIFACT_BYTES: ${MAX_ARTIFACT_BYTES:-5242880}
+  GITEA_PRIVATE_NETWORK_POLICY: ${GITEA_PRIVATE_NETWORK_POLICY:-deny}
+  GITEA_ALLOWED_HOSTS: ${GITEA_ALLOWED_HOSTS:-}
+  GITEA_REQUEST_TIMEOUT_MS: ${GITEA_REQUEST_TIMEOUT_MS:-15000}
+  GITEA_MAX_REDIRECTS: ${GITEA_MAX_REDIRECTS:-3}
+  GITEA_MAX_FILE_BYTES: ${GITEA_MAX_FILE_BYTES:-1048576}
+  GITEA_MAX_FILES_PER_SNAPSHOT: ${GITEA_MAX_FILES_PER_SNAPSHOT:-200}
+  ARTIFACT_RETENTION_DAYS: ${ARTIFACT_RETENTION_DAYS:-90}
+  AUDIT_RETENTION_DAYS: ${AUDIT_RETENTION_DAYS:-180}
+  LOG_RETENTION_DAYS: ${LOG_RETENTION_DAYS:-30}
+  SNAPSHOT_RETENTION_COUNT: ${SNAPSHOT_RETENTION_COUNT:-20}
+  LOG_LEVEL: ${LOG_LEVEL:-info}
+  WORKER_POLL_INTERVAL_MS: ${WORKER_POLL_INTERVAL_MS:-2000}
+  JOB_LEASE_SECONDS: ${JOB_LEASE_SECONDS:-60}
+  REPOSITORY_REFRESH_SCHEDULE_MS: ${REPOSITORY_REFRESH_SCHEDULE_MS:-300000}
+  REPOSITORY_STALE_AFTER_HOURS: ${REPOSITORY_STALE_AFTER_HOURS:-24}
+
+x-app-security: &app-security
+  init: true
+  read_only: true
+  pids_limit: 256
+  mem_limit: 1g
+  tmpfs:
+    - /tmp:size=64m,mode=1777
+  security_opt:
+    - no-new-privileges:true
+  cap_drop:
+    - ALL
+
+services:
+  postgres:
+    image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
+    environment:
+      POSTGRES_DB: devrunbook
+      POSTGRES_USER: devrunbook
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD to a URL-safe random value}
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test:
+        [
+          'CMD-SHELL',
+          'psql -U devrunbook -d devrunbook -tAc "select 1" | grep -qx 1',
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+    restart: unless-stopped
+    pids_limit: 256
+    mem_limit: 1g
+    security_opt:
+      - no-new-privileges:true
+
+  migrate:
+    build:
+      context: .
+      target: migrate
+    environment: *app-environment
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: 'no'
+    read_only: true
+    pids_limit: 128
+    mem_limit: 512m
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+  web:
+    <<: *app-security
+    build:
+      context: .
+      target: web
+    environment: *app-environment
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+    ports:
+      - '127.0.0.1:${DEVRUNBOOK_PORT:-3000}:3000'
+    volumes:
+      - operator-content:/operator-content:ro
+      - artifacts:/artifacts
+    restart: unless-stopped
+
+  worker:
+    <<: *app-security
+    build:
+      context: .
+      target: worker
+    environment: *app-environment
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+    volumes:
+      - operator-content:/operator-content:ro
+      - artifacts:/artifacts
+    restart: unless-stopped
+
+volumes:
+  postgres-data:
+  operator-content:
+  artifacts: