48 lines
1.7 KiB
YAML
48 lines
1.7 KiB
YAML
services:
|
|
dc-amd-proxy:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: dc-amd-proxy
|
|
image: nodedc/dc-amd-proxy:local
|
|
restart: unless-stopped
|
|
# Preserve the real AMD source address for the one-time pairing request.
|
|
# The process itself binds only to the NAS LAN address below; this does not
|
|
# change NAS routes, VPN, DNS, Tailscale, or any other host service.
|
|
network_mode: host
|
|
environment:
|
|
PORT: "8790"
|
|
DC_AMD_PROXY_BIND_ADDRESS: ${DC_AMD_PROXY_BIND_ADDRESS:-172.22.0.222}
|
|
DC_AMD_CONNECTOR_HOST: ${DC_AMD_CONNECTOR_HOST:-172.22.0.183}
|
|
DC_AMD_CONNECTOR_PORT: ${DC_AMD_CONNECTOR_PORT:-8791}
|
|
DC_AMD_PAIR_ALLOWED_SOURCE: ${DC_AMD_PAIR_ALLOWED_SOURCE:-172.22.0.183}
|
|
DC_AMD_CONNECTOR_TOKEN_FILE: /var/lib/dc-amd-proxy/connector-access
|
|
DC_AMD_MAP_EGRESS_TOKEN_FILE: /run/nodedc-secrets/map-egress-proxy-token
|
|
DC_AMD_BODY_IDLE_TIMEOUT_SECONDS: ${DC_AMD_BODY_IDLE_TIMEOUT_SECONDS:-30}
|
|
volumes:
|
|
- type: bind
|
|
source: /volume1/docker/nodedc-platform/secrets/map-egress-proxy-token
|
|
target: /run/nodedc-secrets/map-egress-proxy-token
|
|
read_only: true
|
|
- type: bind
|
|
source: ./runtime
|
|
target: /var/lib/dc-amd-proxy
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,size=8m
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
healthcheck:
|
|
test:
|
|
- CMD-SHELL
|
|
- >
|
|
node -e "fetch('http://'+process.env.DC_AMD_PROXY_BIND_ADDRESS+':8790/healthz')
|
|
.then(r => process.exit(r.ok ? 0 : 1))
|
|
.catch(() => process.exit(1))"
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|