node is host
This commit is contained in:
Yann Autissier
@@ -0,0 +1,11 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
autoheal:
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-autoheal
|
||||
image: willfarrell/autoheal:latest
|
||||
environment:
|
||||
- AUTOHEAL_CONTAINER_LABEL=all
|
||||
restart: always
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
@@ -0,0 +1,21 @@
|
||||
version: "3.6"
|
||||
|
||||
services:
|
||||
restic:
|
||||
image: mazzolino/restic:1.1.1
|
||||
hostname: ${HOSTNAME}
|
||||
environment:
|
||||
BACKUP_CRON: "30 3 * * *"
|
||||
RESTIC_REPOSITORY: ${HOST_RESTIC_REPOSITORY}
|
||||
RESTIC_PASSWORD: ${HOST_RESTIC_PASSWORD}
|
||||
RESTIC_BACKUP_SOURCES: ${HOST_RESTIC_BACKUP_SOURCES:-/var/lib/docker/volumes}
|
||||
RESTIC_BACKUP_TAGS: ${HOST_RESTIC_BACKUP_TAGS:-docker-volumes}
|
||||
RESTIC_FORGET_ARGS: ${HOST_RESTIC_FORGET_ARGS:---prune --keep-last 14 --keep-daily 1}
|
||||
TZ: ${HOST_TZ:-${TZ}}
|
||||
volumes:
|
||||
- restic:/root/.config
|
||||
- /var/lib/docker/volumes:/var/lib/docker/volumes:ro
|
||||
|
||||
volumes:
|
||||
restic:
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
HOST_CERTBOT_UFW_UPDATE ?= 53/udp
|
||||
@@ -0,0 +1,26 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
certbot:
|
||||
build:
|
||||
args:
|
||||
- DOCKER_BUILD_DIR=docker/certbot
|
||||
context: ../..
|
||||
dockerfile: docker/certbot/Dockerfile
|
||||
command: start
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-certbot
|
||||
image: ${HOST_DOCKER_REPOSITORY}/certbot:${DOCKER_IMAGE_TAG}
|
||||
network_mode: host
|
||||
restart: always
|
||||
volumes:
|
||||
- host:/etc/letsencrypt
|
||||
|
||||
volumes:
|
||||
host:
|
||||
external: true
|
||||
name: ${HOST_DOCKER_VOLUME}
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,5 @@
|
||||
ENV_VARS += HOST_CONSUL_ACL_TOKENS_MASTER HOST_CONSUL_HTTP_TOKEN HOST_CONSUL_SERVICE_8500_TAGS
|
||||
HOST_CONSUL_ACL_TOKENS_MASTER ?= 01234567-89ab-cdef-0123-456789abcdef
|
||||
HOST_CONSUL_HTTP_TOKEN ?= $(HOST_CONSUL_ACL_TOKENS_MASTER)
|
||||
HOST_CONSUL_SERVICE_8500_TAGS ?= urlprefix-consul.${DOMAIN}/
|
||||
HOST_CONSUL_UFW_UPDATE ?= 8500
|
||||
@@ -0,0 +1,50 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
consul:
|
||||
build:
|
||||
args:
|
||||
- CONSUL_VERSION=1.11.1
|
||||
- DOCKER_BUILD_DIR=docker/consul
|
||||
context: ../..
|
||||
dockerfile: docker/consul/Dockerfile
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-consul
|
||||
image: ${HOST_DOCKER_REPOSITORY}/consul:${DOCKER_IMAGE_TAG}
|
||||
environment:
|
||||
CONSUL_BIND_INTERFACE: '${DOCKER_HOST_IFACE}'
|
||||
CONSUL_CLIENT_INTERFACE: '${DOCKER_HOST_IFACE}'
|
||||
CONSUL_HTTP_TOKEN: '${HOST_CONSUL_HTTP_TOKEN}'
|
||||
CONSUL_LOCAL_CONFIG: '{ "log_level": "warn"
|
||||
, "enable_script_checks": true
|
||||
, "acl": { "enabled": true
|
||||
, "default_policy": "deny"
|
||||
, "down_policy": "extend-cache"
|
||||
, "enable_token_persistence": true
|
||||
, "tokens": { "initial_management": "${HOST_CONSUL_ACL_TOKENS_MASTER}"
|
||||
, "agent": "${HOST_CONSUL_HTTP_TOKEN}"
|
||||
}
|
||||
}
|
||||
}'
|
||||
hostname: ${HOSTNAME}
|
||||
labels:
|
||||
- SERVICE_8300_IGNORE=true
|
||||
- SERVICE_8301_IGNORE=true
|
||||
- SERVICE_8302_IGNORE=true
|
||||
- SERVICE_8500_CHECK_HTTP=/v1/health/service/consul
|
||||
- SERVICE_8500_NAME=${HOST_COMPOSE_SERVICE_NAME}-consul-8500
|
||||
- SERVICE_8500_TAGS=${HOST_CONSUL_SERVICE_8500_TAGS}
|
||||
- SERVICE_8600_IGNORE=true
|
||||
- SERVICE_ADDRESS=${DOCKER_HOST_INET4}
|
||||
network_mode: host
|
||||
restart: always
|
||||
volumes:
|
||||
- consul:/consul/data:delegated
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
volumes:
|
||||
consul:
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,3 @@
|
||||
ENV_VARS += HOST_EXPORTER_CADVISOR_SERVICE_8080_TAGS HOST_EXPORTER_HOST_SERVICE_9100_TAGS
|
||||
HOST_EXPORTER_CADVISOR_SERVICE_8080_TAGS ?= urlprefix-cadvisor-exporter.${DOMAIN}/
|
||||
HOST_EXPORTER_HOST_SERVICE_9100_TAGS ?= urlprefix-node-exporter.${DOMAIN}/
|
||||
@@ -0,0 +1,27 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
exporter-cadvisor:
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-exporter-cadvisor
|
||||
hostname: ${HOSTNAME}
|
||||
image: google/cadvisor:latest
|
||||
labels:
|
||||
- SERVICE_8080_CHECK_TCP=true
|
||||
- SERVICE_8080_NAME=${HOST_COMPOSE_SERVICE_NAME}-exporter-cadvisor-8080
|
||||
- SERVICE_8080_TAGS=${HOST_EXPORTER_CADVISOR_SERVICE_8080_TAGS}
|
||||
- SERVICE_9200_IGNORE=true
|
||||
networks:
|
||||
- public
|
||||
ports:
|
||||
- 8080
|
||||
restart: always
|
||||
volumes:
|
||||
- /:/rootfs:ro
|
||||
- /sys:/sys:ro
|
||||
- /var/lib/docker/:/var/lib/docker:ro
|
||||
- /var/run:/var/run:rw
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,30 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
exporter-node:
|
||||
command:
|
||||
- --collector.filesystem.ignored-mount-points
|
||||
- "^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)"
|
||||
- '--path.procfs=/host/proc'
|
||||
- '--path.sysfs=/host/sys'
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-exporter-node
|
||||
hostname: ${HOSTNAME}
|
||||
image: prom/node-exporter:latest
|
||||
labels:
|
||||
- SERVICE_9100_CHECK_TCP=true
|
||||
- SERVICE_9100_NAME=${HOST_COMPOSE_SERVICE_NAME}-exporter-node-9100
|
||||
- SERVICE_9100_TAGS=${HOST_EXPORTER_HOST_SERVICE_9100_TAGS}
|
||||
networks:
|
||||
- public
|
||||
ports:
|
||||
- 9100
|
||||
restart: always
|
||||
volumes:
|
||||
- /:/rootfs:ro
|
||||
- /proc:/host/proc:ro
|
||||
- /sys:/host/sys:ro
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,3 @@
|
||||
ENV_VARS += HOST_FABIO_SERVICE_9998_TAGS
|
||||
HOST_FABIO_SERVICE_9998_TAGS ?= urlprefix-fabio.${DOMAIN}/
|
||||
HOST_FABIO_UFW_UPDATE ?= 80/tcp 443/tcp
|
||||
@@ -0,0 +1,48 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
fabio:
|
||||
build:
|
||||
args:
|
||||
- DOCKER_BUILD_DIR=docker/fabio
|
||||
- DOCKER_MACHINE=${DOCKER_MACHINE}
|
||||
- DOCKER_SYSTEM=${DOCKER_SYSTEM}
|
||||
- FABIO_VERSION=1.6.2
|
||||
context: ../..
|
||||
dockerfile: docker/fabio/Dockerfile
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-fabio
|
||||
image: ${HOST_DOCKER_REPOSITORY}/fabio:${DOCKER_IMAGE_TAG}
|
||||
command: -registry.backend "consul" -registry.consul.addr "consul:8500" -registry.consul.token "${HOST_CONSUL_HTTP_TOKEN}" -proxy.addr ":80,:443;cs=local" -proxy.cs "cs=local;type=file;cert=/etc/letsencrypt/live/${DOMAIN}/fullchain.pem;key=/etc/letsencrypt/live/${DOMAIN}/privkey.pem"
|
||||
depends_on:
|
||||
- consul
|
||||
extra_hosts:
|
||||
- consul:${DOCKER_INTERNAL_DOCKER_HOST}
|
||||
hostname: ${HOSTNAME}
|
||||
labels:
|
||||
- SERVICE_80_CHECK_TCP=true
|
||||
- SERVICE_80_NAME=${HOST_COMPOSE_SERVICE_NAME}-fabio-80
|
||||
- SERVICE_443_CHECK_TCP=true
|
||||
- SERVICE_443_NAME=${HOST_COMPOSE_SERVICE_NAME}-fabio-443
|
||||
- SERVICE_9998_CHECK_HTTP=/routes
|
||||
- SERVICE_9998_NAME=${HOST_COMPOSE_SERVICE_NAME}-fabio-9998
|
||||
- SERVICE_9998_TAGS=${HOST_FABIO_SERVICE_9998_TAGS}
|
||||
- SERVICE_9999_IGNORE=true
|
||||
ports:
|
||||
- 80:80/tcp
|
||||
- 443:443/tcp
|
||||
- 9998/tcp
|
||||
networks:
|
||||
- public
|
||||
restart: always
|
||||
volumes:
|
||||
- host:/etc/letsencrypt:ro
|
||||
|
||||
volumes:
|
||||
host:
|
||||
external: true
|
||||
name: ${HOST_DOCKER_VOLUME}
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,95 @@
|
||||
CMDARGS += host-exec stack-host-exec host-exec:% host-exec@% host-run host-run:% host-run@%
|
||||
host ?= $(patsubst stack/%,%,$(patsubst %.yml,%,$(wildcard stack/host/*.yml)))
|
||||
ENV_VARS += DOCKER_HOST_IFACE DOCKER_HOST_INET4 DOCKER_INTERNAL_DOCKER_HOST
|
||||
SETUP_LETSENCRYPT ?=
|
||||
|
||||
# target bootstrap-stack-host: Fire host-certbot host-ssl-certs
|
||||
.PHONY: bootstrap-stack-host
|
||||
bootstrap-stack-host: $(if $(SETUP_LETSENCRYPT),host-certbot$(if $(DEBUG),-staging)) host-ssl-certs
|
||||
|
||||
# target host: Fire stack-host-up
|
||||
.PHONY: host
|
||||
host: stack-host-up
|
||||
|
||||
# target host-%; Fire target stack-host-%
|
||||
.PHONY: host-%
|
||||
host-%: stack-host-%;
|
||||
|
||||
# target host-ssl-certs: Create invalid ${DOMAIN} certificate files with openssl
|
||||
.PHONY: host-ssl-certs
|
||||
host-ssl-certs:
|
||||
docker run --rm --mount source=$(HOST_DOCKER_VOLUME),target=/certs alpine \
|
||||
[ -f /certs/live/$(DOMAIN)/fullchain.pem -a -f /certs/live/$(DOMAIN)/privkey.pem ] \
|
||||
|| $(RUN) docker run --rm \
|
||||
-e DOMAIN=$(DOMAIN) \
|
||||
--mount source=$(HOST_DOCKER_VOLUME),target=/certs \
|
||||
alpine sh -c "\
|
||||
apk --no-cache add openssl \
|
||||
&& mkdir -p /certs/live/${DOMAIN} \
|
||||
&& { [ -f /certs/live/${DOMAIN}/privkey.pem ] || openssl genrsa -out /certs/live/${DOMAIN}/privkey.pem 2048; } \
|
||||
&& openssl req -key /certs/live/${DOMAIN}/privkey.pem -out /certs/live/${DOMAIN}/cert.pem \
|
||||
-addext extendedKeyUsage=serverAuth \
|
||||
-addext subjectAltName=DNS:${DOMAIN},DNS:*.${DOMAIN} \
|
||||
-subj \"/C=/ST=/L=/O=/CN=${DOMAIN}\" \
|
||||
-x509 -days 365 \
|
||||
&& rm -f /certs/live/${DOMAIN}/fullchain.pem \
|
||||
&& ln -s cert.pem /certs/live/${DOMAIN}/fullchain.pem \
|
||||
"
|
||||
|
||||
# target host-certbot: Create ${DOMAIN} certificate files with letsencrypt
|
||||
.PHONY: host-certbot
|
||||
host-certbot: host-docker-build-certbot
|
||||
docker run --rm --mount source=$(HOST_DOCKER_VOLUME),target=/certs alpine \
|
||||
[ -f /certs/live/$(DOMAIN)/cert.pem -a -f /certs/live/$(DOMAIN)/privkey.pem ] \
|
||||
|| $(RUN) docker run --rm \
|
||||
--mount source=$(HOST_DOCKER_VOLUME),target=/etc/letsencrypt/ \
|
||||
--mount source=$(HOST_DOCKER_VOLUME),target=/var/log/letsencrypt/ \
|
||||
-e DOMAIN=$(DOMAIN) \
|
||||
--network host \
|
||||
$(HOST_DOCKER_REPOSITORY)/certbot \
|
||||
--non-interactive --agree-tos --email hostmaster@$(DOMAIN) certonly \
|
||||
--preferred-challenges dns --authenticator dns-standalone \
|
||||
--dns-standalone-address=0.0.0.0 \
|
||||
--dns-standalone-port=53 \
|
||||
-d ${DOMAIN} \
|
||||
-d *.${DOMAIN}
|
||||
|
||||
# target host-certbot-certificates: List letsencrypt certificates
|
||||
.PHONY: host-certbot-certificates
|
||||
host-certbot-certificates: host-docker-build-certbot
|
||||
docker run --rm --mount source=$(HOST_DOCKER_VOLUME),target=/etc/letsencrypt/ $(HOST_DOCKER_REPOSITORY)/certbot certificates
|
||||
|
||||
# target host-certbot-renew: Renew letsencrypt certificates
|
||||
.PHONY: host-certbot-renew
|
||||
host-certbot-renew: host-docker-build-certbot
|
||||
docker run --rm --mount source=$(HOST_DOCKER_VOLUME),target=/etc/letsencrypt/ --network host $(HOST_DOCKER_REPOSITORY)/certbot renew
|
||||
|
||||
# target host-certbot-staging: Create staging ${DOMAIN} certificate files with letsencrypt
|
||||
.PHONY: host-certbot-staging
|
||||
host-certbot-staging: host-docker-build-certbot
|
||||
docker run --rm --mount source=$(HOST_DOCKER_VOLUME),target=/certs alpine \
|
||||
[ -f /certs/live/$(DOMAIN)/cert.pem -a -f /certs/live/$(DOMAIN)/privkey.pem ] \
|
||||
|| $(RUN) docker run --rm \
|
||||
--mount source=$(HOST_DOCKER_VOLUME),target=/etc/letsencrypt/ \
|
||||
--mount source=$(HOST_DOCKER_VOLUME),target=/var/log/letsencrypt/ \
|
||||
-e DOMAIN=$(DOMAIN) \
|
||||
--network host \
|
||||
$(HOST_DOCKER_REPOSITORY)/certbot \
|
||||
--non-interactive --agree-tos --email hostmaster@$(DOMAIN) certonly \
|
||||
--preferred-challenges dns --authenticator dns-standalone \
|
||||
--dns-standalone-address=0.0.0.0 \
|
||||
--dns-standalone-port=53 \
|
||||
--staging \
|
||||
-d ${DOMAIN} \
|
||||
-d *.${DOMAIN}
|
||||
|
||||
# target host-docker-build-%: Build % docker
|
||||
.PHONY: host-docker-build-%
|
||||
host-docker-build-%:
|
||||
$(call docker-build,docker/$*,host/$*:$(DOCKER_IMAGE_TAG))
|
||||
|
||||
# target host-docker-rebuild-%: Rebuild % docker
|
||||
.PHONY: host-docker-rebuild-%
|
||||
host-docker-rebuild-%:
|
||||
$(call make,host-docker-build-$* DOCKER_BUILD_CACHE=false)
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
ENV_VARS += HOST_IPFS_API_HTTPHEADERS_ACA_ORIGIN HOST_IPFS_SERVICE_5001_TAGS HOST_IPFS_SERVICE_8080_TAGS
|
||||
HOST_IPFS_API_HTTPHEADERS_ACA_ORIGIN ?= ["https://ipfs.$(DOMAIN)"]
|
||||
HOST_IPFS_SERVICE_5001_TAGS ?= urlprefix-ipfs.$(DOMAIN)/api
|
||||
HOST_IPFS_SERVICE_8080_TAGS ?= urlprefix-ipfs.$(DOMAIN)/,urlprefix-*.ipfs.$(DOMAIN),urlprefix-ipns.$(DOMAIN)/,urlprefix-*.ipns.$(DOMAIN)/
|
||||
@@ -0,0 +1,96 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
ipfs:
|
||||
build:
|
||||
args:
|
||||
- DOCKER_BUILD_DIR=docker/ipfs
|
||||
- GID=${HOST_GID}
|
||||
- IPFS_VERSION=${IPFS_VERSION}
|
||||
- UID=${HOST_UID}
|
||||
context: ../..
|
||||
dockerfile: docker/ipfs/Dockerfile
|
||||
command: daemon --agent-version-suffix=${HOST_COMPOSE_PROJECT_NAME} ${HOST_IPFS_DAEMON_ARGS:---migrate}
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-ipfs
|
||||
cpus: 0.5
|
||||
environment:
|
||||
- IPFS_ADDRESSES_API=${HOST_IPFS_ADDRESSES_API:-}
|
||||
- IPFS_ADDRESSES_API_DOMAIN=${HOST_IPFS_ADDRESSES_API_DOMAIN:-${DOCKER_NETWORK_PUBLIC}}
|
||||
- IPFS_ADDRESSES_API_INET4=${HOST_IPFS_ADDRESSES_API_INET4:-}
|
||||
- IPFS_ADDRESSES_API_PORT=${HOST_IPFS_ADDRESSES_API_PORT:-}
|
||||
- IPFS_ADDRESSES_GATEWAY=${HOST_IPFS_ADDRESSES_GATEWAY:-}
|
||||
- IPFS_ADDRESSES_GATEWAY_DOMAIN=${HOST_IPFS_ADDRESSES_GATEWAY_DOMAIN:-}
|
||||
- IPFS_ADDRESSES_GATEWAY_INET4=${HOST_IPFS_ADDRESSES_GATEWAY_INET4:-0.0.0.0}
|
||||
- IPFS_ADDRESSES_GATEWAY_PORT=${HOST_IPFS_ADDRESSES_GATEWAY_PORT:-}
|
||||
- IPFS_ADDRESSES_NOANNOUNCE=${HOST_IPFS_ADDRESSES_NOANNOUNCE:-}
|
||||
- IPFS_API_HTTPHEADERS=${HOST_IPFS_API_HTTPHEADERS:-}
|
||||
- IPFS_API_HTTPHEADERS_ACA_CREDENTIALS=${HOST_IPFS_API_HTTPHEADERS_ACA_CREDENTIALS:-["true"]}
|
||||
- IPFS_API_HTTPHEADERS_ACA_HEADERS=${HOST_IPFS_API_HTTPHEADERS_ACA_HEADERS:-["X-Requested-With", "Range", "User-Agent"]}
|
||||
- IPFS_API_HTTPHEADERS_ACA_METHODS=${HOST_IPFS_API_HTTPHEADERS_ACA_METHODS:-["OPTIONS", "POST"]}
|
||||
- IPFS_API_HTTPHEADERS_ACA_ORIGIN=${HOST_IPFS_API_HTTPHEADERS_ACA_ORIGIN:-}
|
||||
- IPFS_BOOTSTRAP=${HOST_IPFS_BOOTSTRAP:-}
|
||||
- IPFS_DATASTORE_GCPERIOD=${HOST_IPFS_DATASTORE_GCPERIOD:-}
|
||||
- IPFS_DISK_USAGE_PERCENT=${HOST_IPFS_DISK_USAGE_PERCENT:-}
|
||||
- IPFS_EXPERIMENTAL_ACCELERATEDDHTCLIENT=${HOST_IPFS_EXPERIMENTAL_ACCELERATEDDHTCLIENT:-}
|
||||
- IPFS_EXPERIMENTAL_FILESTOREENABLED=${HOST_IPFS_EXPERIMENTAL_FILESTOREENABLED:-}
|
||||
- IPFS_EXPERIMENTAL_GRAPHSYNCENABLED=${HOST_IPFS_EXPERIMENTAL_GRAPHSYNCENABLED:-}
|
||||
- IPFS_EXPERIMENTAL_LIBP2PSTREAMMOUNTING=${HOST_IPFS_EXPERIMENTAL_LIBP2PSTREAMMOUNTING:-}
|
||||
- IPFS_EXPERIMENTAL_P2PHTTPPROXY=${HOST_IPFS_EXPERIMENTAL_P2PHTTPPROXY:-}
|
||||
- IPFS_EXPERIMENTAL_STRATEGICPROVIDING=${HOST_IPFS_EXPERIMENTAL_STRATEGICPROVIDING:-}
|
||||
- IPFS_EXPERIMENTAL_URLSTOREENABLED=${HOST_IPFS_EXPERIMENTAL_URLSTOREENABLED:-}
|
||||
- IPFS_IDENTITY_PEERID=${HOST_IPFS_IDENTITY_PEERID:-}
|
||||
- IPFS_IDENTITY_PRIVKEY=${HOST_IPFS_IDENTITY_PRIVKEY:-}
|
||||
- IPFS_IPNS_REPUBLISHPERIOD=${HOST_IPFS_IPNS_REPUBLISHPERIOD:-}
|
||||
- IPFS_IPNS_RECORDLIFETIME=${HOST_IPFS_IPNS_RECORDLIFETIME:-}
|
||||
- IPFS_IPNS_USEPUBSUB=${HOST_IPFS_IPNS_USEPUBSUB:-true}
|
||||
- IPFS_LOGGING=${HOST_IPFS_LOGGING:-error}
|
||||
- IPFS_NETWORK=${HOST_IPFS_NETWORK:-public}
|
||||
- IPFS_PROFILE=${HOST_IPFS_PROFILE:-${IPFS_PROFILE}}
|
||||
- IPFS_PUBSUB_ENABLE=${HOST_IPFS_PUBSUB_ENABLE:-true}
|
||||
- IPFS_PUBSUB_ROUTER=${HOST_IPFS_PUBSUB_ROUTER:-gossipsub}
|
||||
- IPFS_ROUTING_TYPE=${HOST_IPFS_ROUTING_TYPE:-dht}
|
||||
- IPFS_REPROVIDER_INTERVAL=${HOST_IPFS_REPROVIDER_INTERVAL:-}
|
||||
- IPFS_REPROVIDER_STRATEGY=${HOST_IPFS_REPROVIDER_STRATEGY:-}
|
||||
- IPFS_SWARM_CONNMGR_HIGHWATER=${HOST_IPFS_SWARM_CONNMGR_HIGHWATER:-}
|
||||
- IPFS_SWARM_CONNMGR_LOWWATER=${HOST_IPFS_SWARM_CONNMGR_LOWWATER:-}
|
||||
- IPFS_SWARM_CONNMGR_TYPE=${HOST_IPFS_SWARM_CONNMGR_TYPE:-}
|
||||
- IPFS_SWARM_DISABLENATPORTMAP=${HOST_IPFS_SWARM_DISABLENATPORTMAP:-}
|
||||
- IPFS_SWARM_ENABLEHOLEPUNCHING=${HOST_IPFS_SWARM_ENABLEHOLEPUNCHING:-}
|
||||
- IPFS_SWARM_KEY=${HOST_IPFS_SWARM_KEY:-}
|
||||
- IPFS_SWARM_RELAYCLIENT_ENABLED=${HOST_IPFS_SWARM_RELAYCLIENT_ENABLED:-}
|
||||
- IPFS_SWARM_RELAYSERVICE_ENABLED=${HOST_IPFS_SWARM_RELAYSERVICE_ENABLED:-}
|
||||
- IPFS_SWARM_TRANSPORTS_NETWORK_RELAY=${HOST_IPFS_SWARM_TRANSPORTS_NETWORK_RELAY:-}
|
||||
image: ${HOST_DOCKER_REPOSITORY}/ipfs:${DOCKER_IMAGE_TAG}
|
||||
labels:
|
||||
- SERVICE_4001_CHECK_TCP=true
|
||||
- SERVICE_4001_NAME=${HOST_COMPOSE_SERVICE_NAME}-ipfs-4001
|
||||
- SERVICE_5001_CHECK_HTTP=${HOST_IPFS_SERVICE_5001_CHECK_HTTP:-/api/v0/diag/sys}
|
||||
- SERVICE_5001_CHECK_HTTP_METHOD=${HOST_IPFS_SERVICE_5001_CHECK_HTTP_METHOD:-POST}
|
||||
- SERVICE_5001_NAME=${HOST_COMPOSE_SERVICE_NAME}-ipfs-5001
|
||||
- SERVICE_5001_TAGS=${HOST_IPFS_SERVICE_5001_TAGS:-}
|
||||
- SERVICE_8080_CHECK_HTTP=${HOST_IPFS_SERVICE_8080_CHECK_HTTP:-/ipfs/QmYwAPJzv5CZsnA625s3Xf2nemtYgPpHdWEz79ojWnPbdG/readme}
|
||||
- SERVICE_8080_NAME=${HOST_COMPOSE_SERVICE_NAME}-ipfs-8080
|
||||
- SERVICE_8080_TAGS=${HOST_IPFS_SERVICE_8080_TAGS:-}
|
||||
- SERVICE_8081_IGNORE=true
|
||||
networks:
|
||||
- public
|
||||
ports:
|
||||
- 4001:4001/tcp
|
||||
- 4001:4001/udp
|
||||
- 5001:5001/tcp
|
||||
- 8080:8080/tcp
|
||||
restart: always
|
||||
ulimits:
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- ipfs:/data/ipfs:delegated
|
||||
|
||||
volumes:
|
||||
ipfs:
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,6 @@
|
||||
# ENV_VARS += HOST_MAILSERVER_ENABLE_MANAGESIEVE HOST_MAILSERVER_SPOOF_PROTECTION HOST_MAILSERVER_SSL_TYPE HOST_MAILSERVER_ENABLE_UPDATE_CHECK
|
||||
HOST_MAILSERVER_ENABLE_MANAGESIEVE ?= 1
|
||||
HOST_MAILSERVER_SPOOF_PROTECTION ?= 1
|
||||
HOST_MAILSERVER_SSL_TYPE ?= letsencrypt
|
||||
HOST_MAILSERVER_ENABLE_UPDATE_CHECK ?= 0
|
||||
HOST_MAILSERVER_UFW_DOCKER ?= 25/tcp 465/tcp 587/tcp 993/tcp
|
||||
@@ -0,0 +1,166 @@
|
||||
version: '2'
|
||||
services:
|
||||
mailserver:
|
||||
image: mailserver/docker-mailserver:11.2
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-mailserver
|
||||
cpus: 0.5
|
||||
domainname: ${DOMAIN}
|
||||
environment:
|
||||
- OVERRIDE_HOSTNAME=${HOST_MAILSERVER_OVERRIDE_HOSTNAME:-}
|
||||
- DMS_DEBUG=${HOST_MAILSERVER_DMS_DEBUG:-0}
|
||||
- LOG_LEVEL=${HOST_MAILSERVER_LOG_LEVEL:-info}
|
||||
- SUPERVISOR_LOGLEVEL=${HOST_MAILSERVER_SUPERVISOR_LOGLEVEL:-}
|
||||
- ONE_DIR=${HOST_MAILSERVER_ONE_DIR:-1}
|
||||
- ACCOUNT_PROVISIONER=${HOST_MAILSERVER_ACCOUNT_PROVISIONER:-}
|
||||
- POSTMASTER_ADDRESS=${HOST_MAILSERVER_POSTMASTER_ADDRESS:-}
|
||||
- ENABLE_UPDATE_CHECK=${HOST_MAILSERVER_ENABLE_UPDATE_CHECK:-0}
|
||||
- UPDATE_CHECK_INTERVAL=${HOST_MAILSERVER_UPDATE_CHECK_INTERVAL:-1d}
|
||||
- PERMIT_DOCKER=${HOST_MAILSERVER_PERMIT_DOCKER:-none}
|
||||
- TZ=${HOST_MAILSERVER_TZ:-${TZ}}
|
||||
- NETWORK_INTERFACE=${HOST_MAILSERVER_NETWORK_INTERFACE:-}
|
||||
- TLS_LEVEL=${HOST_MAILSERVER_TLS_LEVEL:-}
|
||||
- SPOOF_PROTECTION=${HOST_MAILSERVER_SPOOF_PROTECTION:-1}
|
||||
- ENABLE_SRS=${HOST_MAILSERVER_ENABLE_SRS:-0}
|
||||
- ENABLE_POP3=${HOST_MAILSERVER_ENABLE_POP3:-}
|
||||
- ENABLE_CLAMAV=${HOST_MAILSERVER_ENABLE_CLAMAV:-0}
|
||||
- ENABLE_AMAVIS=${HOST_MAILSERVER_ENABLE_AMAVIS:-1}
|
||||
- AMAVIS_LOGLEVEL=${HOST_MAILSERVER_AMAVIS_LOGLEVEL:-0}
|
||||
- ENABLE_DNSBL=${HOST_MAILSERVER_ENABLE_DNSBL:-0}
|
||||
- ENABLE_FAIL2BAN=${HOST_MAILSERVER_ENABLE_FAIL2BAN:-0}
|
||||
- FAIL2BAN_BLOCKTYPE=${HOST_MAILSERVER_FAIL2BAN_BLOCKTYPE:-drop}
|
||||
- ENABLE_MANAGESIEVE=${HOST_MAILSERVER_ENABLE_MANAGESIEVE:-1}
|
||||
- POSTSCREEN_ACTION=${HOST_MAILSERVER_POSTSCREEN_ACTION:-enforce}
|
||||
- SMTP_ONLY=${HOST_MAILSERVER_SMTP_ONLY:-}
|
||||
- SSL_TYPE=${HOST_MAILSERVER_SSL_TYPE:-letsencrypt}
|
||||
- SSL_CERT_PATH=${HOST_MAILSERVER_SSL_CERT_PATH:-}
|
||||
- SSL_KEY_PATH=${HOST_MAILSERVER_SSL_KEY_PATH:-}
|
||||
- SSL_ALT_CERT_PATH=${HOST_MAILSERVER_SSL_ALT_CERT_PATH:-}
|
||||
- SSL_ALT_KEY_PATH=${HOST_MAILSERVER_SSL_ALT_KEY_PATH:-}
|
||||
- VIRUSMAILS_DELETE_DELAY=${HOST_MAILSERVER_VIRUSMAILS_DELETE_DELAY:-}
|
||||
- ENABLE_POSTFIX_VIRTUAL_TRANSPORT=${HOST_MAILSERVER_ENABLE_POSTFIX_VIRTUAL_TRANSPORT:-}
|
||||
- POSTFIX_DAGENT=${HOST_MAILSERVER_POSTFIX_DAGENT:-}
|
||||
- POSTFIX_MAILBOX_SIZE_LIMIT=${HOST_MAILSERVER_POSTFIX_MAILBOX_SIZE_LIMIT:-}
|
||||
- ENABLE_QUOTAS=${HOST_MAILSERVER_ENABLE_QUOTAS:-1}
|
||||
- POSTFIX_MESSAGE_SIZE_LIMIT=${HOST_MAILSERVER_POSTFIX_MESSAGE_SIZE_LIMIT:-}
|
||||
- CLAMAV_MESSAGE_SIZE_LIMIT=${HOST_MAILSERVER_CLAMAV_MESSAGE_SIZE_LIMIT:-}
|
||||
- PFLOGSUMM_TRIGGER=${HOST_MAILSERVER_PFLOGSUMM_TRIGGER:-}
|
||||
- PFLOGSUMM_RECIPIENT=${HOST_MAILSERVER_PFLOGSUMM_RECIPIENT:-}
|
||||
- PFLOGSUMM_SENDER=${HOST_MAILSERVER_PFLOGSUMM_SENDER:-}
|
||||
- LOGWATCH_INTERVAL=${HOST_MAILSERVER_LOGWATCH_INTERVAL:-}
|
||||
- LOGWATCH_RECIPIENT=${HOST_MAILSERVER_LOGWATCH_RECIPIENT:-}
|
||||
- LOGWATCH_SENDER=${HOST_MAILSERVER_LOGWATCH_SENDER:-}
|
||||
- REPORT_RECIPIENT=${HOST_MAILSERVER_REPORT_RECIPIENT:-}
|
||||
- REPORT_SENDER=${HOST_MAILSERVER_REPORT_SENDER:-}
|
||||
- LOGROTATE_INTERVAL=${HOST_MAILSERVER_LOGROTATE_INTERVAL:-weekly}
|
||||
- POSTFIX_INET_PROTOCOLS=${HOST_MAILSERVER_POSTFIX_INET_PROTOCOLS:-all}
|
||||
- DOVECOT_INET_PROTOCOLS=${HOST_MAILSERVER_DOVECOT_INET_PROTOCOLS:-all}
|
||||
- ENABLE_SPAMASSASSIN=${HOST_MAILSERVER_ENABLE_SPAMASSASSIN:-0}
|
||||
- SPAMASSASSIN_SPAM_TO_INBOX=${HOST_MAILSERVER_SPAMASSASSIN_SPAM_TO_INBOX:-1}
|
||||
- ENABLE_SPAMASSASSIN_KAM=${HOST_MAILSERVER_ENABLE_SPAMASSASSIN_KAM:-0}
|
||||
- MOVE_SPAM_TO_JUNK=${HOST_MAILSERVER_MOVE_SPAM_TO_JUNK:-1}
|
||||
- SA_TAG=${HOST_MAILSERVER_SA_TAG:-2.0}
|
||||
- SA_TAG2=${HOST_MAILSERVER_SA_TAG2:-6.31}
|
||||
- SA_KILL=${HOST_MAILSERVER_SA_KILL:-6.31}
|
||||
- SA_SPAM_SUBJECT=${HOST_MAILSERVER_SA_SPAM_SUBJECT:-***SPAM*****}
|
||||
- ENABLE_FETCHMAIL=${HOST_MAILSERVER_ENABLE_FETCHMAIL:-0}
|
||||
- FETCHMAIL_POLL=${HOST_MAILSERVER_FETCHMAIL_POLL:-300}
|
||||
- ENABLE_LDAP=${HOST_MAILSERVER_ENABLE_LDAP:-}
|
||||
- LDAP_START_TLS=${HOST_MAILSERVER_LDAP_START_TLS:-}
|
||||
- LDAP_SERVER_HOST=${HOST_MAILSERVER_LDAP_SERVER_HOST:-}
|
||||
- LDAP_SEARCH_BASE=${HOST_MAILSERVER_LDAP_SEARCH_BASE:-}
|
||||
- LDAP_BIND_DN=${HOST_MAILSERVER_LDAP_BIND_DN:-}
|
||||
- LDAP_BIND_PW=${HOST_MAILSERVER_LDAP_BIND_PW:-}
|
||||
- LDAP_QUERY_FILTER_USER=${HOST_MAILSERVER_LDAP_QUERY_FILTER_USER:-}
|
||||
- LDAP_QUERY_FILTER_GROUP=${HOST_MAILSERVER_LDAP_QUERY_FILTER_GROUP:-}
|
||||
- LDAP_QUERY_FILTER_ALIAS=${HOST_MAILSERVER_LDAP_QUERY_FILTER_ALIAS:-}
|
||||
- LDAP_QUERY_FILTER_DOMAIN=${HOST_MAILSERVER_LDAP_QUERY_FILTER_DOMAIN:-}
|
||||
- DOVECOT_TLS=${HOST_MAILSERVER_DOVECOT_TLS:-}
|
||||
- DOVECOT_USER_FILTER=${HOST_MAILSERVER_DOVECOT_USER_FILTER:-}
|
||||
- DOVECOT_PASS_FILTER=${HOST_MAILSERVER_DOVECOT_PASS_FILTER:-}
|
||||
- DOVECOT_MAILBOX_FORMAT=${HOST_MAILSERVER_DOVECOT_MAILBOX_FORMAT:-maildir}
|
||||
- DOVECOT_AUTH_BIND=${HOST_MAILSERVER_DOVECOT_AUTH_BIND:-}
|
||||
- ENABLE_POSTGREY=${HOST_MAILSERVER_ENABLE_POSTGREY:-0}
|
||||
- POSTGREY_DELAY=${HOST_MAILSERVER_POSTGREY_DELAY:-300}
|
||||
- POSTGREY_MAX_AGE=${HOST_MAILSERVER_POSTGREY_MAX_AGE:-35}
|
||||
- POSTGREY_TEXT=${HOST_MAILSERVER_POSTGREY_TEXT:-"Delayed by Postgrey"}
|
||||
- POSTGREY_AUTO_WHITELIST_CLIENTS=${HOST_MAILSERVER_POSTGREY_AUTO_WHITELIST_CLIENTS:-5}
|
||||
- ENABLE_SASLAUTHD=${HOST_MAILSERVER_ENABLE_SASLAUTHD:-0}
|
||||
- SASLAUTHD_MECHANISMS=${HOST_MAILSERVER_SASLAUTHD_MECHANISMS:-}
|
||||
- SASLAUTHD_MECH_OPTIONS=${HOST_MAILSERVER_SASLAUTHD_MECH_OPTIONS:-}
|
||||
- SASLAUTHD_LDAP_SERVER=${HOST_MAILSERVER_SASLAUTHD_LDAP_SERVER:-}
|
||||
- SASLAUTHD_LDAP_BIND_DN=${HOST_MAILSERVER_SASLAUTHD_LDAP_BIND_DN:-}
|
||||
- SASLAUTHD_LDAP_PASSWORD=${HOST_MAILSERVER_SASLAUTHD_LDAP_PASSWORD:-}
|
||||
- SASLAUTHD_LDAP_SEARCH_BASE=${HOST_MAILSERVER_SASLAUTHD_LDAP_SEARCH_BASE:-}
|
||||
- SASLAUTHD_LDAP_FILTER=${HOST_MAILSERVER_SASLAUTHD_LDAP_FILTER:-}
|
||||
- SASLAUTHD_LDAP_START_TLS=${HOST_MAILSERVER_SASLAUTHD_LDAP_START_TLS:-}
|
||||
- SASLAUTHD_LDAP_TLS_CHECK_PEER=${HOST_MAILSERVER_SASLAUTHD_LDAP_TLS_CHECK_PEER:-}
|
||||
- SASLAUTHD_LDAP_TLS_CACERT_FILE=${HOST_MAILSERVER_SASLAUTHD_LDAP_TLS_CACERT_FILE:-}
|
||||
- SASLAUTHD_LDAP_TLS_CACERT_DIR=${HOST_MAILSERVER_SASLAUTHD_LDAP_TLS_CACERT_DIR:-}
|
||||
- SASLAUTHD_LDAP_PASSWORD_ATTR=${HOST_MAILSERVER_SASLAUTHD_LDAP_PASSWORD_ATTR:-}
|
||||
- SASL_PASSWD=${HOST_MAILSERVER_SASL_PASSWD:-}
|
||||
- SASLAUTHD_LDAP_AUTH_METHOD=${HOST_MAILSERVER_SASLAUTHD_LDAP_AUTH_METHOD:-}
|
||||
- SASLAUTHD_LDAP_MECH=${HOST_MAILSERVER_SASLAUTHD_LDAP_MECH:-}
|
||||
- SRS_SENDER_CLASSES=${HOST_MAILSERVER_SRS_SENDER_CLASSES:-envelope_sender}
|
||||
- SRS_EXCLUDE_DOMAINS=${HOST_MAILSERVER_SRS_EXCLUDE_DOMAINS:-}
|
||||
- SRS_SECRET=${HOST_MAILSERVER_SRS_SECRET:-}
|
||||
- DEFAULT_RELAY_HOST=${HOST_MAILSERVER_DEFAULT_RELAY_HOST:-}
|
||||
- RELAY_HOST=${HOST_MAILSERVER_RELAY_HOST:-}
|
||||
- RELAY_PORT=${HOST_MAILSERVER_RELAY_PORT:-25}
|
||||
- RELAY_USER=${HOST_MAILSERVER_RELAY_USER:-}
|
||||
- RELAY_PASSWORD=${HOST_MAILSERVER_RELAY_PASSWORD:-}
|
||||
healthcheck:
|
||||
test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
|
||||
timeout: 3s
|
||||
retries: 0
|
||||
hostname: ${HOSTNAME}
|
||||
labels:
|
||||
- SERVICE_25_CHECK_TCP=true
|
||||
- SERVICE_25_NAME=${HOST_COMPOSE_SERVICE_NAME}-mailserver-25
|
||||
- SERVICE_110_IGNORE=true
|
||||
- SERVICE_143_CHECK_TCP=true
|
||||
- SERVICE_143_NAME=${HOST_COMPOSE_SERVICE_NAME}-mailserver-143
|
||||
- SERVICE_465_CHECK_TCP=true
|
||||
- SERVICE_465_NAME=${HOST_COMPOSE_SERVICE_NAME}-mailserver-465
|
||||
- SERVICE_587_CHECK_TCP=true
|
||||
- SERVICE_587_NAME=${HOST_COMPOSE_SERVICE_NAME}-mailserver-587
|
||||
- SERVICE_993_CHECK_TCP=true
|
||||
- SERVICE_993_NAME=${HOST_COMPOSE_SERVICE_NAME}-mailserver-993
|
||||
- SERVICE_995_IGNORE=true
|
||||
- SERVICE_4190_CHECK_TCP=true
|
||||
- SERVICE_4190_NAME=${HOST_COMPOSE_SERVICE_NAME}-mailserver-4190
|
||||
networks:
|
||||
- private
|
||||
- public
|
||||
ports:
|
||||
- "25:25"
|
||||
- "143:143"
|
||||
- "465:465"
|
||||
- "587:587"
|
||||
- "993:993"
|
||||
volumes:
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- mailserver-config:/tmp/docker-mailserver/
|
||||
- mailserver-data:/var/mail
|
||||
- mailserver-logs:/var/log/mail
|
||||
- mailserver-state:/var/mail-state
|
||||
- host:/etc/letsencrypt:ro
|
||||
restart: always
|
||||
stop_grace_period: 1m
|
||||
volumes:
|
||||
mailserver-config:
|
||||
mailserver-data:
|
||||
mailserver-logs:
|
||||
mailserver-state:
|
||||
host:
|
||||
external: true
|
||||
name: ${HOST_DOCKER_VOLUME}
|
||||
|
||||
networks:
|
||||
private:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PRIVATE}
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,15 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
pdns-recursor:
|
||||
build:
|
||||
args:
|
||||
- DOCKER_BUILD_DIR=docker/pdns-server
|
||||
context: ../..
|
||||
dockerfile: docker/pdns-server/Dockerfile
|
||||
command: /usr/local/sbin/pdns_recursor --allow-from='127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16'
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-pdns-recursor
|
||||
hostname: ${HOSTNAME}
|
||||
image: ${HOST_DOCKER_REPOSITORY}/pdns-recursor:${DOCKER_IMAGE_TAG}
|
||||
network_mode: host
|
||||
restart: always
|
||||
@@ -0,0 +1,2 @@
|
||||
ENV_VARS += HOST_PORTAINER_SERVICE_9000_TAGS
|
||||
HOST_PORTAINER_SERVICE_9000_TAGS ?= urlprefix-portainer.${DOMAIN}/
|
||||
@@ -0,0 +1,28 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
portainer:
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-portainer
|
||||
image: portainer/portainer:latest
|
||||
labels:
|
||||
- SERVICE_8000_IGNORE=true
|
||||
- SERVICE_9000_CHECK_HTTP=/
|
||||
- SERVICE_9000_NAME=${HOST_COMPOSE_SERVICE_NAME}-portainer-9000
|
||||
- SERVICE_9000_TAGS=${HOST_PORTAINER_SERVICE_9000_TAGS}
|
||||
networks:
|
||||
- public
|
||||
ports:
|
||||
- 8000
|
||||
- 9000
|
||||
restart: always
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- portainer:/data
|
||||
|
||||
volumes:
|
||||
portainer:
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,31 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
registrator:
|
||||
build:
|
||||
args:
|
||||
- DOCKER_BUILD_DIR=docker/registrator
|
||||
- GIT_AUTHOR_NAME=${GIT_AUTHOR_NAME}
|
||||
- GIT_AUTHOR_EMAIL=${GIT_AUTHOR_EMAIL}
|
||||
context: ../..
|
||||
dockerfile: docker/registrator/Dockerfile
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-registrator
|
||||
image: ${HOST_DOCKER_REPOSITORY}/registrator:${DOCKER_IMAGE_TAG}
|
||||
command: -internal -cleanup -deregister always -resync=30 -useIpFromNetwork "${DOCKER_NETWORK_PUBLIC}" -useIpFromLabel SERVICE_ADDRESS consul://consul:8500
|
||||
depends_on:
|
||||
- consul
|
||||
environment:
|
||||
- CONSUL_HTTP_TOKEN=${HOST_CONSUL_HTTP_TOKEN}
|
||||
- GL_DISABLE_VERSION_CHECK=true
|
||||
extra_hosts:
|
||||
- consul:${DOCKER_INTERNAL_DOCKER_HOST}
|
||||
hostname: ${HOSTNAME}
|
||||
network_mode: host
|
||||
restart: always
|
||||
volumes:
|
||||
- /var/run/docker.sock:/tmp/docker.sock
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
@@ -0,0 +1,61 @@
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
vdi:
|
||||
build:
|
||||
args:
|
||||
- DOCKER_BUILD_DIR=docker/x2go/xfce-debian
|
||||
- SSH_PORT=${HOST_SSH_PORT:-${SSH_PORT}}
|
||||
context: ../..
|
||||
dockerfile: docker/x2go/xfce-debian/Dockerfile
|
||||
cap_add:
|
||||
- IPC_LOCK # ecryptfs
|
||||
- NET_ADMIN # iptables
|
||||
- NET_RAW # iptables
|
||||
- SYS_ADMIN # ecryptfs
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-vdi
|
||||
cpus: 0.5
|
||||
environment:
|
||||
- DEBUG=${VDI_DEBUG:-}
|
||||
- ECRYPTERS=${HOST_VDI_ECRYPTERS:-${USER}}
|
||||
- LANG=${HOST_VDI_LANG:-C.UTF-8}
|
||||
- SSH_PORT=${HOST_SSH_PORT:-${SSH_PORT}}
|
||||
- SSH_AUTHORIZED_KEYS=${SSH_AUTHORIZED_KEYS:-}
|
||||
- SSH_PUBLIC_HOSTS=${HOST_SSH_PUBLIC_HOSTS:-${SSH_PUBLIC_HOSTS}}
|
||||
- SUDOERS=${HOST_VDI_SUDOERS:-${USER}}
|
||||
- TZ=${HOST_VDI_TZ:-}
|
||||
- USERS=${HOST_VDI_USERS:-${USER}}
|
||||
image: ${HOST_DOCKER_REPOSITORY}/vdi:${DOCKER_IMAGE_TAG}
|
||||
networks:
|
||||
- public
|
||||
ports:
|
||||
- ${HOST_VDI_PORT:-22}:${SSH_PORT:-22}
|
||||
restart: unless-stopped
|
||||
security_opt:
|
||||
- apparmor=unconfined # ecryptfs
|
||||
- seccomp=unconfined # ecryptfs
|
||||
tty: true
|
||||
volumes:
|
||||
- home:/home:delegated
|
||||
- shared:/shared:cached
|
||||
- shm:/dev/shm:delegated
|
||||
|
||||
networks:
|
||||
public:
|
||||
external: true
|
||||
name: ${DOCKER_NETWORK_PUBLIC}
|
||||
|
||||
volumes:
|
||||
home:
|
||||
shared:
|
||||
driver: local
|
||||
driver_opts:
|
||||
type: none
|
||||
device: /mnt/shared
|
||||
o: bind
|
||||
shm:
|
||||
driver: local
|
||||
driver_opts:
|
||||
type: tmpfs
|
||||
device: tmpfs
|
||||
o: mode=1777,size=2147483648 # 2GB
|
||||
@@ -0,0 +1,38 @@
|
||||
version: '3.6'
|
||||
|
||||
services:
|
||||
vsftpd-s3:
|
||||
build:
|
||||
args:
|
||||
- DOCKER_BUILD_DIR=docker/vsftpd-s3
|
||||
context: ../..
|
||||
dockerfile: docker/vsftpd-s3/Dockerfile
|
||||
cap_add:
|
||||
- sys_admin
|
||||
container_name: ${HOST_COMPOSE_PROJECT_NAME}-vsftpd-s3
|
||||
devices:
|
||||
- /dev/fuse
|
||||
environment:
|
||||
- AWS_ACCESS_KEY_ID=${HOST_VSFTPD_S3_AWS_ACCESS_KEY_ID:-${AWS_ACCESS_KEY_ID}}
|
||||
- AWS_SECRET_ACCESS_KEY=${HOST_VSFTPD_S3_AWS_SECRET_ACCESS_KEY:-${AWS_SECRET_ACCESS_KEY}}
|
||||
- DIR_REMOTE=${HOST_VSFTPD_S3_DIR_REMOTE}
|
||||
- FTP_HOST=${HOST_VSFTPD_S3_FTP_HOST}
|
||||
- FTP_PASS=${HOST_VSFTPD_S3_FTP_PASS}
|
||||
- FTP_SYNC=${HOST_VSFTPD_S3_FTP_SYNC}
|
||||
- FTP_USER=${HOST_VSFTPD_S3_FTP_USER}
|
||||
- FTPD_USER=${HOST_VSFTPD_S3_FTPD_USER}
|
||||
- FTPD_USERS=${HOST_VSFTPD_S3_FTPD_USERS}
|
||||
- PASV_MAX_PORT=${HOST_VSFTPD_S3_PASV_MAX_PORT}
|
||||
- PASV_MIN_PORT=${HOST_VSFTPD_S3_PASV_MIN_PORT}
|
||||
hostname: ${HOSTNAME}
|
||||
image: ${HOST_DOCKER_REPOSITORY}/vsftpd-s3:${DOCKER_IMAGE_TAG}
|
||||
labels:
|
||||
- SERVICE_21_CHECK_TCP=true
|
||||
- SERVICE_21_NAME=${HOST_COMPOSE_SERVICE_NAME}-vsftpd-s3-21
|
||||
- SERVICE_22_CHECK_TCP=true
|
||||
- SERVICE_22_NAME=${HOST_COMPOSE_SERVICE_NAME}-vsftpd-s3-22
|
||||
- SERVICE_65000_IGNORE=true
|
||||
security_opt:
|
||||
- apparmor:unconfined
|
||||
network_mode: host
|
||||
restart: always
|
||||
Reference in New Issue
Block a user