48 lines
1.6 KiB
YAML
48 lines
1.6 KiB
YAML
services:
|
|
dc-amd-connector:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: dc-amd-connector
|
|
image: nodedc/dc-amd-connector:local
|
|
restart: unless-stopped
|
|
# This is a byte-forwarding gateway, not a map renderer. These are circuit
|
|
# breakers for the shared workstation, not normal throughput limits.
|
|
cpus: "1.00"
|
|
mem_limit: 256m
|
|
pids_limit: 64
|
|
ulimits:
|
|
nofile:
|
|
soft: 4096
|
|
hard: 4096
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
PORT: "8791"
|
|
AMD_CONNECTOR_ACCESS_TOKEN_FILE: /run/dc-amd-secrets/connector-access
|
|
# Bind only to the stable LAN address of the AMD host, never all Windows
|
|
# interfaces and never the OpenVPN adapter address.
|
|
ports:
|
|
- "${AMD_CONNECTOR_BIND_IP:?set AMD_CONNECTOR_BIND_IP}:${AMD_CONNECTOR_PORT:-8791}:8791"
|
|
volumes:
|
|
- type: bind
|
|
source: ./runtime/connector-access
|
|
target: /run/dc-amd-secrets/connector-access
|
|
read_only: true
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,size=8m
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
healthcheck:
|
|
test:
|
|
- CMD-SHELL
|
|
- >
|
|
node -e "const fs=require('fs'),http=require('http');const t=fs.readFileSync('/run/dc-amd-secrets/connector-access','utf8').trim();const r=http.get({host:'127.0.0.1',port:8791,path:'/healthz',headers:{'proxy-authorization':'Bearer '+t}},x=>process.exit(x.statusCode===200?0:1));r.on('error',()=>process.exit(1))"
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|