129 lines
4.1 KiB
YAML
129 lines
4.1 KiB
YAML
name: devrunbook
|
|
|
|
x-app-environment: &app-environment
|
|
DATABASE_URL: postgresql://devrunbook:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD to a URL-safe random value}@postgres:5432/devrunbook
|
|
PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:?Set PUBLIC_BASE_URL to the exact externally visible URL}
|
|
SESSION_SECRET: ${SESSION_SECRET:?Set SESSION_SECRET to at least 32 random bytes}
|
|
INTEGRATION_ENCRYPTION_KEY: ${INTEGRATION_ENCRYPTION_KEY:?Set INTEGRATION_ENCRYPTION_KEY to a base64-encoded 32-byte key}
|
|
INTEGRATION_ENCRYPTION_KEY_VERSION: ${INTEGRATION_ENCRYPTION_KEY_VERSION:-v1}
|
|
INTEGRATION_ENCRYPTION_OLD_KEYS: '${INTEGRATION_ENCRYPTION_OLD_KEYS:-{}}'
|
|
CONTENT_ROOT: /content
|
|
ARTIFACT_ROOT: /artifacts
|
|
BOOTSTRAP_TOKEN: ${BOOTSTRAP_TOKEN:?Set BOOTSTRAP_TOKEN to a random first-run token}
|
|
REGISTRATION_MODE: ${REGISTRATION_MODE:-closed}
|
|
TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-}
|
|
MAINTENANCE_MODE: ${MAINTENANCE_MODE:-false}
|
|
MAX_IMPORT_BYTES: ${MAX_IMPORT_BYTES:-10485760}
|
|
MAX_EXPANDED_ARCHIVE_BYTES: ${MAX_EXPANDED_ARCHIVE_BYTES:-52428800}
|
|
MAX_ARCHIVE_FILES: ${MAX_ARCHIVE_FILES:-500}
|
|
MAX_SINGLE_FILE_BYTES: ${MAX_SINGLE_FILE_BYTES:-5242880}
|
|
MAX_PROMPT_BYTES: ${MAX_PROMPT_BYTES:-2097152}
|
|
MAX_EVIDENCE_BYTES: ${MAX_EVIDENCE_BYTES:-262144}
|
|
MAX_ARTIFACT_BYTES: ${MAX_ARTIFACT_BYTES:-5242880}
|
|
GITEA_PRIVATE_NETWORK_POLICY: ${GITEA_PRIVATE_NETWORK_POLICY:-deny}
|
|
GITEA_ALLOWED_HOSTS: ${GITEA_ALLOWED_HOSTS:-}
|
|
GITEA_REQUEST_TIMEOUT_MS: ${GITEA_REQUEST_TIMEOUT_MS:-15000}
|
|
GITEA_MAX_REDIRECTS: ${GITEA_MAX_REDIRECTS:-3}
|
|
GITEA_MAX_FILE_BYTES: ${GITEA_MAX_FILE_BYTES:-1048576}
|
|
GITEA_MAX_FILES_PER_SNAPSHOT: ${GITEA_MAX_FILES_PER_SNAPSHOT:-200}
|
|
ARTIFACT_RETENTION_DAYS: ${ARTIFACT_RETENTION_DAYS:-90}
|
|
AUDIT_RETENTION_DAYS: ${AUDIT_RETENTION_DAYS:-180}
|
|
LOG_RETENTION_DAYS: ${LOG_RETENTION_DAYS:-30}
|
|
SNAPSHOT_RETENTION_COUNT: ${SNAPSHOT_RETENTION_COUNT:-20}
|
|
LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
WORKER_POLL_INTERVAL_MS: ${WORKER_POLL_INTERVAL_MS:-2000}
|
|
JOB_LEASE_SECONDS: ${JOB_LEASE_SECONDS:-60}
|
|
REPOSITORY_REFRESH_SCHEDULE_MS: ${REPOSITORY_REFRESH_SCHEDULE_MS:-300000}
|
|
REPOSITORY_STALE_AFTER_HOURS: ${REPOSITORY_STALE_AFTER_HOURS:-24}
|
|
|
|
x-app-security: &app-security
|
|
init: true
|
|
read_only: true
|
|
pids_limit: 256
|
|
mem_limit: 1g
|
|
tmpfs:
|
|
- /tmp:size=64m,mode=1777
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
|
|
environment:
|
|
POSTGRES_DB: devrunbook
|
|
POSTGRES_USER: devrunbook
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD to a URL-safe random value}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test:
|
|
[
|
|
'CMD-SHELL',
|
|
'psql -U devrunbook -d devrunbook -tAc "select 1" | grep -qx 1',
|
|
]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 10s
|
|
restart: unless-stopped
|
|
pids_limit: 256
|
|
mem_limit: 1g
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
migrate:
|
|
build:
|
|
context: .
|
|
target: migrate
|
|
environment: *app-environment
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
restart: 'no'
|
|
read_only: true
|
|
pids_limit: 128
|
|
mem_limit: 512m
|
|
tmpfs:
|
|
- /tmp:size=64m,mode=1777
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
|
|
web:
|
|
<<: *app-security
|
|
build:
|
|
context: .
|
|
target: web
|
|
environment: *app-environment
|
|
depends_on:
|
|
migrate:
|
|
condition: service_completed_successfully
|
|
ports:
|
|
- '127.0.0.1:${DEVRUNBOOK_PORT:-3000}:3000'
|
|
volumes:
|
|
- operator-content:/operator-content:ro
|
|
- artifacts:/artifacts
|
|
restart: unless-stopped
|
|
|
|
worker:
|
|
<<: *app-security
|
|
build:
|
|
context: .
|
|
target: worker
|
|
environment: *app-environment
|
|
depends_on:
|
|
migrate:
|
|
condition: service_completed_successfully
|
|
volumes:
|
|
- operator-content:/operator-content:ro
|
|
- artifacts:/artifacts
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres-data:
|
|
operator-content:
|
|
artifacts:
|