feedback/compose.deploy.yaml at main · cppsocial/feedback · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: cppsocial-feedback

services:
  feedback:
    build:
      context: .
      target: production
    image: feedback-service:local
    command:
      - --config=/run/config/sites.toml
      - --github-app-private-key-file=/run/secrets/github-app-private-key
      - --github-client-secret-file=/run/secrets/github-client-secret
      - --oauth-state-hmac-key-file=/run/secrets/oauth-state-hmac-key
      - --forwarded-allow-ips=172.17.0.1
      - --limit-concurrency=64
      - --keep-alive-seconds=5
    restart: unless-stopped
    init: true
    read_only: true
    user: "10001:10001"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 64
    mem_limit: 256m
    mem_reservation: 128m
    cpus: 1.0
    ports:
      - "127.0.0.1:18080:8080"
    volumes:
      - ./config/sites.toml:/run/config/sites.toml:ro
      - feedback-data:/data
    secrets:
      - github-app-private-key
      - github-client-secret
      - oauth-state-hmac-key
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m,uid=10001,gid=10001
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - "import socket; socket.create_connection(('127.0.0.1', 8080), 2).close()"
      interval: 30s
      timeout: 3s
      start_period: 10s
      retries: 3
    stop_grace_period: 20s
    ulimits:
      nofile:
        soft: 1024
        hard: 2048
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

secrets:
  github-app-private-key:
    file: ./config/secrets/github-app-private-key.pem
  github-client-secret:
    file: ./config/secrets/github-client-secret
  oauth-state-hmac-key:
    file: ./config/secrets/oauth-state-hmac-key

volumes:
  feedback-data: