cesnimda
bfa8cfd357
- rewrote homelab (content + topology diagram + stack) from a live inspection of the host: Ubuntu 24.04, ~30 Docker services behind Traefik (Cloudflare-fronted, TLS, HTTP/3), Authentik SSO forward-auth, CrowdSec, Pi-hole, self-hosted Gitea + CI runner, socket-proxy, per-app network isolation; WordPress framed as being decommissioned (not future arch) - deploy: docker-compose now uses Traefik labels + traefik_proxy network (was assumed nginx edge); .env.example adds SITE_HOST/TRAEFIK_ENTRYPOINT; colophon + ARCHITECTURE/DOCKER/ DEPLOYMENT specs corrected nginx-edge -> Traefik (site container still serves via nginx) - PROJECT_STATUS: pre-launch checklist updated; infra section added Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65 lines
2.4 KiB
YAML
65 lines
2.4 KiB
YAML
# Production stack (DOCKER_SPEC §2). Publishes no host ports — Traefik (the host's
|
|
# existing reverse proxy) discovers these containers on the shared traefik_proxy
|
|
# network via the labels below and routes cesnimda.co.uk to the site, and
|
|
# cesnimda.co.uk/api/contact to the relay. Entrypoint / cert-resolver names match
|
|
# the host Traefik convention; override via the .env values if they differ.
|
|
|
|
services:
|
|
site:
|
|
build:
|
|
context: ../site
|
|
dockerfile: Dockerfile
|
|
image: git.cesnimda.uk/cesnimda/resumesite-site:latest
|
|
restart: unless-stopped
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
- /var/cache/nginx
|
|
- /var/run
|
|
networks: [proxy]
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=${PROXY_NETWORK:-traefik_proxy}
|
|
- traefik.http.routers.resumesite.rule=Host(`${SITE_HOST:-cesnimda.co.uk}`)
|
|
- traefik.http.routers.resumesite.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure-external}
|
|
- traefik.http.routers.resumesite.tls=true
|
|
- traefik.http.services.resumesite.loadbalancer.server.port=8080
|
|
logging:
|
|
driver: json-file
|
|
options: { max-size: '10m', max-file: '3' }
|
|
|
|
relay:
|
|
build:
|
|
context: ../relay
|
|
dockerfile: Dockerfile
|
|
image: git.cesnimda.uk/cesnimda/resumesite-relay:latest
|
|
restart: unless-stopped
|
|
read_only: true
|
|
environment:
|
|
- Smtp__Host=${SMTP_HOST}
|
|
- Smtp__Port=${SMTP_PORT:-587}
|
|
- Smtp__User=${SMTP_USER}
|
|
- Smtp__Password=${SMTP_PASSWORD}
|
|
- Relay__FromAddress=${RELAY_FROM:-}
|
|
- Relay__ToAddress=${RELAY_TO}
|
|
- Relay__AllowedOrigin=${RELAY_ALLOWED_ORIGIN:-https://cesnimda.co.uk}
|
|
- Relay__RateLimitPerWindow=${RELAY_RATE_LIMIT:-5}
|
|
- Relay__WindowSeconds=${RELAY_WINDOW_SECONDS:-600}
|
|
networks: [proxy]
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=${PROXY_NETWORK:-traefik_proxy}
|
|
# More specific rule than the site router, so /api/contact wins.
|
|
- traefik.http.routers.resumerelay.rule=Host(`${SITE_HOST:-cesnimda.co.uk}`) && PathPrefix(`/api/contact`)
|
|
- traefik.http.routers.resumerelay.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure-external}
|
|
- traefik.http.routers.resumerelay.tls=true
|
|
- traefik.http.services.resumerelay.loadbalancer.server.port=8081
|
|
logging:
|
|
driver: json-file
|
|
options: { max-size: '10m', max-file: '3' }
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
name: ${PROXY_NETWORK:-traefik_proxy}
|