grendervill
4bd1770cb5
- deploy/install.sh: идемпотентная установка, режимы встроенного и внешнего прокси (§10.13), --dry-run/--skip-tls/--reconfigure, auto-детект профиля (§10.10) - deploy/compose.yaml.tpl: app, livekit, caddy с лимитами, healthcheck, ротацией логов, cap_drop и no-new-privileges (§4.3) - deploy/caddy: Caddyfile.tpl (встроенный) и external-proxy.conf.tpl (наш стенд) - deploy/livekit: конфиг с TURN, dynacast и лимитами комнат (§10.6) - deploy/backup.sh + restore.sh: sqlite .backup, tar, age-шифрование (§10.8) - deploy/update.sh: бэкап → pull/сборка → up → миграции → smoke (§9.3) - deploy/smoke.sh: проверки §10.9 (healthz/readyz/meta, порты, UFW, fail2ban, бэкап) - deploy/security-check.sh: аудит SSH, UFW, fail2ban, прав .env и ключей - deploy/ufw-docker.sh, nftables и fail2ban-конфиги (sshd, glchat-auth, recidive) - deploy/glchat-cli.sh: команды §10.7, systemd-юнит glchat.service - scripts/test-install.sh: прогон установщика в чистом Ubuntu 24.04 (systemd-контейнер) - Dockerfile: multi-stage (node → golang CGO → debian-slim), non-root, healthcheck - Makefile: lint/test/build/dev/generate/security/smoke и фиксация версий инструментов
116 lines
3.0 KiB
Smarty
116 lines
3.0 KiB
Smarty
# Сгенерировано deploy/install.sh — не редактируйте вручную, изменения перезапишутся.
|
|
# Шаблон: deploy/compose.yaml.tpl. Профиль: {{PROFILE}}
|
|
name: glchat
|
|
|
|
x-logging: &default-logging
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
x-app-env: &app-env
|
|
DOMAIN: "{{DOMAIN}}"
|
|
FILES_DOMAIN: "{{FILES_DOMAIN}}"
|
|
INSTANCE_NAME: "{{INSTANCE_NAME}}"
|
|
LISTEN_ADDR: "0.0.0.0:8080"
|
|
DATA_DIR: "/app/data"
|
|
WEB_ROOT: "/app/web"
|
|
LOG_LEVEL: "{{LOG_LEVEL}}"
|
|
LOG_FORMAT: "json"
|
|
SQLITE_READ_POOL: "{{SQLITE_READ_POOL}}"
|
|
SQLITE_CACHE_SIZE: "{{SQLITE_CACHE_SIZE}}"
|
|
SQLITE_MMAP_SIZE: "{{SQLITE_MMAP_SIZE}}"
|
|
GOMAXPROCS: "{{GOMAXPROCS}}"
|
|
MAX_UPLOAD_SIZE: "{{MAX_UPLOAD_SIZE}}"
|
|
SHUTDOWN_TIMEOUT_SECONDS: "20"
|
|
|
|
services:
|
|
app:
|
|
image: {{APP_IMAGE}}
|
|
container_name: glchat-app
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
<<: *app-env
|
|
ports:
|
|
- "127.0.0.1:{{APP_PORT}}:8080"
|
|
volumes:
|
|
- "{{DATA_DIR}}/db:/app/data/db"
|
|
- "{{DATA_DIR}}/files:/app/data/files"
|
|
- "{{DATA_DIR}}/backups:/app/data/backups"
|
|
logging: *default-logging
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "{{APP_CPUS}}"
|
|
memory: {{APP_MEMORY_LIMIT}}
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/healthz"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 20s
|
|
retries: 3
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
|
|
livekit:
|
|
image: livekit/livekit-server:{{LIVEKIT_IMAGE_TAG}}
|
|
container_name: glchat-livekit
|
|
restart: unless-stopped
|
|
command: ["--config", "/etc/livekit.yaml"]
|
|
environment:
|
|
LIVEKIT_KEYS: "{{LIVEKIT_API_KEY}}: {{LIVEKIT_API_SECRET}}"
|
|
ports:{{LIVEKIT_PORTS}}
|
|
volumes:
|
|
- ./livekit/livekit.yaml:/etc/livekit.yaml:ro
|
|
logging: *default-logging
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "{{LIVEKIT_CPUS}}"
|
|
memory: {{LIVEKIT_MEMORY_LIMIT}}
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:7880"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 15s
|
|
retries: 3
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- NET_BIND_SERVICE
|
|
|
|
caddy:
|
|
image: caddy:{{CADDY_IMAGE_TAG}}
|
|
container_name: glchat-caddy
|
|
restart: unless-stopped
|
|
profiles: ["{{CADDY_PROFILE}}"]
|
|
ports:
|
|
- "{{HTTP_PORT}}:80"
|
|
- "{{HTTPS_PORT}}:443"
|
|
- "{{HTTPS_PORT}}:443/udp"
|
|
volumes:
|
|
- ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- ./caddy/data:/data
|
|
- ./caddy/config:/config
|
|
- ./caddy/logs:/var/log/caddy
|
|
logging: *default-logging
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "{{CADDY_CPUS}}"
|
|
memory: {{CADDY_MEMORY_LIMIT}}
|
|
healthcheck:
|
|
test: ["CMD", "caddy", "version"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 10s
|
|
retries: 3
|
|
security_opt:
|
|
- no-new-privileges:true
|