Tim-Conrad.github.io/docker-compose.dev.yml at master · Tim-Conrad/Tim-Conrad.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# The review site: this clone with live reload and the papercuts widget (scripts/review/devserver.py), in the lab behind its
# login. GitHub Pages still serves t7d.dev from gh-pages. This stack never touches it.
#
#   # first, else Docker makes the folders as root:
#   mkdir -p .review/approve .review/approve-status .papercuts ~/code/worktrees/t7d
#   scripts/review/approve-install.sh   # once: the host side of the Approve button (a systemd user unit)
#   # .env (gitignored): REVIEW_HOST=<host>, REVIEW_MAIN=<host path of this clone>,
#   # REVIEW_WORKTREES=<host path of the folder with the site worktrees>
#   # REVIEW_PAPERCUTS_HOST=<host of the relay>, PAPERCUTS_SRC=<folder of the relay source with its Dockerfile>
#   docker-compose -p t7d-review -f docker-compose.dev.yml up -d --build
#   docker-compose -p t7d-review -f docker-compose.dev.yml down
#
# The clone and the worktrees are read-only in the container, at their host paths (git needs the same paths).
# The review server writes only the approve request to .review/approve. It reads the status of the host from .review/approve-status.
# The relay container writes only to .papercuts (the local store of papercuts).
# The page shows the branch of ?branch=, else of the cookie, else of the clone. The image adds only the package git.
services:
  t7d-review:
    build:
      context: scripts/review
      dockerfile: Dockerfile
    image: t7d-review:local
    container_name: t7d-review
    restart: unless-stopped
    user: "1001:1001"
    command: [python3, "${REVIEW_MAIN:?set REVIEW_MAIN in .env}/scripts/review/devserver.py", --root, "${REVIEW_MAIN}", --worktrees, "${REVIEW_WORKTREES}", --host, 0.0.0.0, --port, "8000"]
    environment:
      PYTHONDONTWRITEBYTECODE: "1"
      PAPERCUTS_URL: https://${REVIEW_PAPERCUTS_HOST:?set REVIEW_PAPERCUTS_HOST in .env}
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 96m
    tmpfs:
      - /tmp:size=8m,mode=1777
    logging: { driver: json-file, options: { max-size: "10m", max-file: "3" } }
    volumes:
      - ${REVIEW_MAIN}:${REVIEW_MAIN}:ro
      - ${REVIEW_WORKTREES:?set REVIEW_WORKTREES in .env}:${REVIEW_WORKTREES}:ro
      - ${REVIEW_MAIN}/.review/approve:${REVIEW_MAIN}/.review/approve:rw
      - ${REVIEW_MAIN}/.review/approve-status:${REVIEW_MAIN}/.review/approve-status:ro
    networks: [proxy]            # no ports: the lab proxy routes to it
    labels:
      - traefik.enable=true
      - traefik.http.routers.t7d-review.rule=Host(`${REVIEW_HOST:?set REVIEW_HOST in .env}`)
      - traefik.http.routers.t7d-review.entrypoints=websecure
      - traefik.http.routers.t7d-review.tls=true
      - traefik.http.routers.t7d-review.middlewares=authelia@file,security-headers@file
      - traefik.http.services.t7d-review.loadbalancer.server.port=8000
      - homepage.group=Apps
      - homepage.name=t7d.dev (Review)
      - homepage.description=Working copy with live reload and papercuts
      - homepage.href=https://${REVIEW_HOST}

  t7d-review-papercuts:
    build: ${PAPERCUTS_SRC:?set PAPERCUTS_SRC in .env}
    container_name: t7d-review-papercuts
    restart: unless-stopped
    user: "1001:1001"
    environment:
      PAPERCUTS_STORE: local
      PAPERCUTS_DB: /data/papercuts.db
      PAPERCUTS_HOST: 0.0.0.0
      PAPERCUTS_ORIGINS: https://${REVIEW_HOST}
      PAPERCUTS_REPOS: Tim-Conrad/Tim-Conrad.github.io
      PAPERCUTS_PUBLIC_URL: https://${REVIEW_PAPERCUTS_HOST}
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 128m
    tmpfs:
      - /tmp
    logging: { driver: json-file, options: { max-size: "10m", max-file: "3" } }
    volumes:
      - ${REVIEW_MAIN}/.papercuts:/data:rw
    networks: [proxy]            # no ports: the lab proxy routes to it
    labels:
      - traefik.enable=true
      - traefik.http.routers.t7d-review-papercuts.rule=Host(`${REVIEW_PAPERCUTS_HOST}`)
      - traefik.http.routers.t7d-review-papercuts.entrypoints=websecure
      - traefik.http.routers.t7d-review-papercuts.tls=true
      - traefik.http.routers.t7d-review-papercuts.middlewares=authelia@file,security-headers@file
      - traefik.http.services.t7d-review-papercuts.loadbalancer.server.port=8000

networks:
  proxy:
    external: true