Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docker-compose.validation-tls.yml

@@ -0,0 +1,33 @@
+# Dedicated candidate HTTPS entry point. Render with the base, production, and
+# candidate ingress overlays, then run the isolation preflight before startup.
+# The key files must be copies confined to the candidate root, never an NPM bind.
+services:
+  tls:
+    image: caddy:2.10-alpine@sha256:4c6e91c6ed0e2fa03efd5b44747b625fec79bc9cd06ac5235a779726618e530d
+    command: ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+    environment:
+      XDG_CONFIG_HOME: /config
+      XDG_DATA_HOME: /data
+    volumes:
+      - ./deploy/validation/Caddyfile:/etc/caddy/Caddyfile:ro
+      - ${MODELFORGE_CANDIDATE_TLS_DIR:?set a certificate copy directory inside the candidate root}/fullchain.pem:/run/tls/fullchain.pem:ro
+      - ${MODELFORGE_CANDIDATE_TLS_DIR:?set a certificate copy directory inside the candidate root}/privkey.pem:/run/tls/privkey.pem:ro
+    networks:
+      - ingress
+    ports:
+      - "0.0.0.0:18444:8443"
+    read_only: true
+    tmpfs:
+      - /config:size=4m,mode=0700
+      - /data:size=4m,mode=0700
+      - /tmp:size=4m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    depends_on:
+      api:
+        condition: service_healthy
+      web:
+        condition: service_started
+    restart: unless-stopped