StasonJatham
fac79b6215
- rename ctcloud -> bucketeer everywhere (cmd/bucketeer, binary, compose service) - group brand assets under assets/ (light/dark logo + UI screenshot) - move long-form docs under docs/ (ARCHITECTURE, DESIGN, GOAL) and add docs/SKILL.md: how an agent queries/audits a running instance and answers user questions from the API and PostgreSQL - README: large logo (light/dark picture) and UI screenshot, repository layout - .gitignore: /bucketeer, .env, pgdata, build/test artifacts, OS junk - .dockerignore: keep brand/docs/markdown out of the build context
65 lines
2.0 KiB
YAML
65 lines
2.0 KiB
YAML
# Local / single-host deployment.
|
|
#
|
|
# Secrets come from .env (gitignored). Copy .env.example to .env and set a
|
|
# strong POSTGRES_PASSWORD plus a matching DATABASE_URL before `docker compose
|
|
# up`. For a production database, point DATABASE_URL at a TLS-enabled endpoint,
|
|
# e.g. postgres://user:[email protected]:5432/bucketeer?sslmode=verify-full
|
|
#
|
|
# The compose bridge network is private; sslmode=disable is only acceptable here
|
|
# because the database is not reachable from outside the stack.
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-bucketeer}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
|
|
POSTGRES_DB: ${POSTGRES_DB:-bucketeer}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-bucketeer} -d ${POSTGRES_DB:-bucketeer}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 12
|
|
mem_limit: 1g
|
|
cpus: 2.0
|
|
pids_limit: 256
|
|
logging:
|
|
driver: json-file
|
|
options: { max-size: "10m", max-file: "3" }
|
|
restart: unless-stopped
|
|
|
|
bucketeer:
|
|
build: .
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
# All optional tuning (DNS_SERVERS, PROBE_*, BUCKET_SCAN_*, UI_USER, ...)
|
|
# comes from .env. Leave DNS_SERVERS unset to use the curated resolvers.
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
METRICS_ADDR: ":9090"
|
|
# Loopback by default. Set UI_BIND=0.0.0.0 in .env to reach the UI/metrics
|
|
# from another host (there is no auth unless UI_USER/UI_PASS is set).
|
|
ports:
|
|
- "${UI_BIND:-127.0.0.1}:9090:9090"
|
|
# No application volume: the container is stateless apart from PostgreSQL.
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=16m,noexec,nosuid
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
mem_limit: 1g
|
|
cpus: 2.0
|
|
pids_limit: 512
|
|
logging:
|
|
driver: json-file
|
|
options: { max-size: "10m", max-file: "3" }
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
pgdata:
|