mirror of
https://github.com/Patiun/com.gregkilmer.www.git
synced 2026-11-07 19:58:24 +00:00
Claude
754c6482be
- Dockerfile with a check target (typecheck and tests) and one image per service on a pinned Node 22.20 Alpine base, each with only its own production dependencies and a health check. - deploy/compose.yaml: gk-content, gk-admin and gk-site on homelab_network with no host ports, read-only root filesystems, no capabilities, the vault's Site folder mounted into the content service, and backup.dump=sqlite on it. - deploy/deploy.sh builds and checks the commit, restarts the stack, and goes back to the last good tag if it doesn't come up healthy; rollback.sh swaps tags. .gitea/workflows/deploy.yml runs it on a host runner on Cosmos. - docs/deploy.md runbook (settings, runner, mirror, NPM hosts, Turnstile, Healthchecks, backups, cutover) and the stack's inventory note in vault-kit. - Site: trusts X-Forwarded-Host/Proto for gregkilmer.com hosts so form posts pass Astro's origin check behind the proxy; rate limits read CF-Connecting-IP; site URL set for absolute links. - Content service: the held-change webhook carries a Discord-ready message; .env.example lists the core settings. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx
67 lines
2.0 KiB
YAML
67 lines
2.0 KiB
YAML
# The GregKilmer.com stack on Cosmos: content service, admin page and public site.
|
|
#
|
|
# Lives at /home/greg/homelab/gregkilmer/compose.yaml (the Gitea Actions deploy
|
|
# copies it there from deploy/compose.yaml on every build). Settings:
|
|
# .env stack settings: GK_TAG, VAULT_SITE, PUID, PGID (deploy/stack.env.example)
|
|
# content.env content service secrets (services/content/.env.example)
|
|
# admin.env admin page settings (deploy/admin.env.example)
|
|
# site.env public site secrets (services/site/.env.example)
|
|
#
|
|
# No service publishes a host port. Nginx Proxy Manager reaches them by
|
|
# container name on homelab_network. See docs/deploy.md.
|
|
|
|
name: gregkilmer
|
|
|
|
x-common: &common
|
|
restart: unless-stopped
|
|
user: "${PUID:-1000}:${PGID:-1000}"
|
|
networks: [homelab_network]
|
|
read_only: true
|
|
tmpfs: [/tmp]
|
|
security_opt: ["no-new-privileges:true"]
|
|
cap_drop: [ALL]
|
|
|
|
services:
|
|
gk-content:
|
|
<<: *common
|
|
image: gregkilmer/content:${GK_TAG:?set GK_TAG in .env}
|
|
container_name: gk-content
|
|
env_file: content.env
|
|
environment:
|
|
SITE_DIR: /vault/Site
|
|
DATA_DIR: /data
|
|
volumes:
|
|
# The vault's Site folder. Read-write: accepted API and MCP changes are
|
|
# written back into the notes.
|
|
- ${VAULT_SITE:?set VAULT_SITE in .env}:/vault/Site
|
|
# content.db (notes, history, review queue, saved forms, sync cache) and
|
|
# submissions/ (form attachments). Both are backed up.
|
|
- ./data/content:/data
|
|
labels:
|
|
backup.dump: sqlite
|
|
|
|
gk-admin:
|
|
<<: *common
|
|
image: gregkilmer/admin:${GK_TAG}
|
|
container_name: gk-admin
|
|
env_file: admin.env
|
|
environment:
|
|
CONTENT_URL: http://gk-content:4310
|
|
depends_on:
|
|
gk-content: { condition: service_healthy }
|
|
|
|
gk-site:
|
|
<<: *common
|
|
image: gregkilmer/site:${GK_TAG}
|
|
container_name: gk-site
|
|
env_file: site.env
|
|
environment:
|
|
CONTENT_URL: http://gk-content:4310
|
|
depends_on:
|
|
gk-content: { condition: service_healthy }
|
|
|
|
networks:
|
|
homelab_network:
|
|
name: homelab_network
|
|
external: true
|