28 lines
1.2 KiB
YAML
28 lines
1.2 KiB
YAML
|
# Deploy separately behind a proper TLS proxy. No publication credentials.
|
||
|
|
# Example: docker compose -f compose.yaml -f compose.s3-gateway.example.yaml up -d --build
|
||
|
|
services:
|
||
|
|
s3-site-gateway:
|
||
|
|
image: siteforge/web:8.21.0-dev.1
|
||
|
|
depends_on:
|
||
|
|
siteforge: {condition: service_started}
|
||
|
|
command: ["python", "-m", "uvicorn", "app.s3_gateway:app", "--host", "0.0.0.0", "--port", "8791"]
|
||
|
|
restart: unless-stopped
|
||
|
|
environment:
|
||
|
|
SITEFORGE_S3_GATEWAY_BUCKET: ${SITEFORGE_PRODUCTION_S3_BUCKET:?Set S3 bucket}
|
||
|
|
SITEFORGE_S3_GATEWAY_REGION: ${SITEFORGE_PRODUCTION_S3_REGION:?Set region}
|
||
|
|
SITEFORGE_S3_GATEWAY_PREFIX: ${SITEFORGE_PRODUCTION_S3_PREFIX:-siteforge}
|
||
|
|
# Supply read-only IAM role via workload identity; do not put keys in source files.
|
||
|
|
ports:
|
||
|
|
- "127.0.0.1:${SITEFORGE_GATEWAY_PORT:-8791}:8791"
|
||
|
|
read_only: true
|
||
|
|
tmpfs:
|
||
|
|
- /tmp:size=64m,mode=1777
|
||
|
|
cap_drop: [ALL]
|
||
|
|
security_opt: ["no-new-privileges:true"]
|
||
|
|
pids_limit: 64
|
||
|
|
healthcheck:
|
||
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8791/health', timeout=3)"]
|
||
|
|
interval: 30s
|
||
|
|
timeout: 5s
|
||
|
|
retries: 3
|