ce54d488f2
cloudflared binds 127.0.0.1:2000 on the HOST. This process runs in a container whose only route to the host is the bridge gateway (172.17.0.1), where nothing is listening — so the check was permanently red regardless of what the tunnel was actually doing. Binding the metrics endpoint wider would have fixed the probe and made a metrics bind failure capable of taking down ingress. That is a worse trade than losing one row on a dashboard. The check is not silently dropped: /health/full now carries a 'not_checked_here' map naming the tunnel and where its health actually lives (systemd windygit-tunnel). An observer should never have to wonder whether a missing check means healthy or means forgotten. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
66 lines
2.7 KiB
YAML
66 lines
2.7 KiB
YAML
# G0.5 — committed, secrets stripped.
|
|
#
|
|
# Three compose files that wire production to its databases currently exist in
|
|
# exactly one place on earth (SOTU section 5.6.3): windy-pro's postgres override,
|
|
# Mind's WireGuard override, and WindyCloud's kit0 override — the last of which
|
|
# had to be reconstructed after an `rsync --delete` ate it once. This cell will
|
|
# not add a fourth. Real values come from .env, which is gitignored.
|
|
|
|
name: windy-git
|
|
|
|
services:
|
|
api:
|
|
build:
|
|
context: .
|
|
args:
|
|
# I-12: baked at build time. A runtime COMMIT_SHA override is ignored.
|
|
COMMIT_SHA: ${COMMIT_SHA_BUILD:-}
|
|
BUILT_AT: ${BUILT_AT:-}
|
|
env_file: [.env]
|
|
environment:
|
|
DATABASE_URL: postgresql+asyncpg://windygit:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/windygit
|
|
GITEA_BASE_URL: http://gitea:3000
|
|
# Loopback ONLY. cloudflared runs on the host and reaches us over 127.0.0.1;
|
|
# nothing needs to be reachable from the LAN, let alone the internet (G1.6).
|
|
ports: ["127.0.0.1:${API_PORT:-8600}:8600"]
|
|
depends_on: {db: {condition: service_healthy}}
|
|
restart: unless-stopped
|
|
|
|
gitea:
|
|
# G2.1 — PIN AN EXACT VERSION. Never `latest`. Record it in SUBSTRATE.md.
|
|
image: docker.io/gitea/gitea:1.24.6
|
|
environment:
|
|
GITEA__database__DB_TYPE: postgres
|
|
GITEA__database__HOST: db:5432
|
|
GITEA__database__NAME: gitea
|
|
GITEA__database__USER: gitea
|
|
GITEA__database__PASSWD: ${GITEA_DB_PASSWORD:?set GITEA_DB_PASSWORD}
|
|
GITEA__repository__DEFAULT_BRANCH: main
|
|
GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:-http://localhost:3000/}
|
|
# G2.2 — OIDC only. No local password login, no self-registration.
|
|
GITEA__service__DISABLE_REGISTRATION: "true"
|
|
GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
|
|
GITEA__lfs__PATH: /data/lfs
|
|
volumes:
|
|
# I-3: git object databases on a POSIX filesystem. Never object storage.
|
|
- ${GIT_DATA_ROOT:-./data/gitea}:/data
|
|
# Loopback only, and the host port is configurable: Veron 1 is Grant's
|
|
# workstation and already has other projects on 3000 (a node dev server) and
|
|
# 3300 (nginx). A deploy must never fight a resident process for a port.
|
|
ports: ["127.0.0.1:${GITEA_PORT:-3080}:3000"]
|
|
depends_on: {db: {condition: service_healthy}}
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: docker.io/library/postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: windygit
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
|
|
POSTGRES_DB: windygit
|
|
volumes: ["./data/pg:/var/lib/postgresql/data"]
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U windygit"]
|
|
interval: 5s
|
|
retries: 10
|
|
restart: unless-stopped
|