dev_agentandClaude Opus 5.5
e1ca23f595
deploy/compose.yaml defines project "mealquest": the mealquest service built
from the root Dockerfile, running as 10001:10001, configured from deploy/.env
and Docker secrets in deploy/secrets/, with the mealquest-data volume at
/data, published on ${MEALQUEST_BIND_ADDRESS}:8090, a /health healthcheck and
restart unless-stopped, on the private mealquest network.
deploy/.env.example documents every MEALQUEST_* variable: the ones operators
set, the ones fixed by compose.yaml, and the planned ones not yet read.
.gitignore keeps deploy/.env and deploy/secrets/ out while tracking the
example.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
# Production stack for MealQuest on 10.60.1.14 (D-018). Build and start on
|
|
# the host with:
|
|
#
|
|
# docker compose -f deploy/compose.yaml up -d --build
|
|
#
|
|
# Configuration comes from deploy/.env (copy deploy/.env.example) and secrets
|
|
# from deploy/secrets/; neither is committed. Compose bind-mounts file secrets
|
|
# with their host owner and mode, so each file in deploy/secrets/ must be
|
|
# owned by the container user 10001:10001 with mode 0600.
|
|
name: mealquest
|
|
|
|
services:
|
|
mealquest:
|
|
build:
|
|
context: ..
|
|
dockerfile: Dockerfile
|
|
user: "10001:10001"
|
|
restart: unless-stopped
|
|
env_file:
|
|
- path: .env
|
|
required: true
|
|
# Fixed by this file's container shape (listen port, volume, secret
|
|
# mounts); deploy/.env must not set them.
|
|
environment:
|
|
MEALQUEST_HTTP_ADDR: ":8080"
|
|
MEALQUEST_DATA_DIR: /data
|
|
MEALQUEST_SECRET_KEY_FILE: /run/secrets/secret_key
|
|
MEALQUEST_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_secret
|
|
secrets:
|
|
- secret_key
|
|
- oidc_client_secret
|
|
volumes:
|
|
- mealquest-data:/data
|
|
ports:
|
|
- "${MEALQUEST_BIND_ADDRESS:?set MEALQUEST_BIND_ADDRESS in deploy/.env}:8090:8080"
|
|
networks:
|
|
- mealquest
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/health"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
start_period: 10s
|
|
retries: 3
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
|
|
secrets:
|
|
secret_key:
|
|
file: ./secrets/secret_key
|
|
oidc_client_secret:
|
|
file: ./secrets/oidc_client_secret
|
|
|
|
volumes:
|
|
mealquest-data:
|
|
name: mealquest-data
|
|
|
|
networks:
|
|
mealquest:
|
|
name: mealquest
|