34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
# Dedicated candidate HTTPS entry point. Render with the base, production, and
|
|
# candidate ingress overlays, then run the isolation preflight before startup.
|
|
# The key files must be copies confined to the candidate root, never an NPM bind.
|
|
services:
|
|
tls:
|
|
image: caddy:2.10-alpine@sha256:4c6e91c6ed0e2fa03efd5b44747b625fec79bc9cd06ac5235a779726618e530d
|
|
command: ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
|
|
environment:
|
|
XDG_CONFIG_HOME: /config
|
|
XDG_DATA_HOME: /data
|
|
volumes:
|
|
- ./deploy/validation/Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- ${MODELFORGE_CANDIDATE_TLS_DIR:?set a certificate copy directory inside the candidate root}/fullchain.pem:/run/tls/fullchain.pem:ro
|
|
- ${MODELFORGE_CANDIDATE_TLS_DIR:?set a certificate copy directory inside the candidate root}/privkey.pem:/run/tls/privkey.pem:ro
|
|
networks:
|
|
- ingress
|
|
ports:
|
|
- "0.0.0.0:18444:8443"
|
|
read_only: true
|
|
tmpfs:
|
|
- /config:size=4m,mode=0700
|
|
- /data:size=4m,mode=0700
|
|
- /tmp:size=4m,mode=1777
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
web:
|
|
condition: service_started
|
|
restart: unless-stopped
|