peter
441d000d33
Addresses a review of deploy/cloud_agent_deploy.md against Cloud-VM-1 (a shared Hetzner VPS already running ~10 other services, including the Forgejo instance this repo is hosted on): - Blocking: git.cygnus.systems' git-SSH listens on port 2222, not 22 - fixed the SSH config example and clone fallback, with a note not to assume 22 if it changes again. - High: container port now binds via configurable DAYBOOK_BIND_ADDR (defaults to all interfaces, set to 127.0.0.1 when a reverse proxy fronts it) instead of always publishing to 0.0.0.0; reverse-proxy+TLS is now the only path presented for internet-facing hosts, not a coequal option with direct exposure. - High: replaced the Caddy-only hardening example with an Apache vhost + certbot path (matching how this specific host already terminates TLS for everything else on it), plus a check-before-assuming-80/443-are-free step. - High: added mem_limit/mem_reservation to docker-compose.yml so this doesn't risk OOM-killing other services on a memory-tight box. - Medium: added configurable DAYBOOK_HOST_DATA_DIR so persistent data can land on a separate/larger volume instead of a space-constrained main disk. - Medium/Low: checklist now prompts checking the target's own service-inventory/monitoring/changelog conventions, and .env guidance notes it should stay low-stakes since a deploy agent reads/writes it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
21 lines
510 B
YAML
21 lines
510 B
YAML
services:
|
|
daybook:
|
|
build:
|
|
context: ..
|
|
dockerfile: deploy/Dockerfile
|
|
container_name: daybook
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
mem_limit: 384m
|
|
mem_reservation: 128m
|
|
ports:
|
|
- "${DAYBOOK_BIND_ADDR:-0.0.0.0}:8000:8000"
|
|
volumes:
|
|
- ${DAYBOOK_HOST_DATA_DIR:-./data}:/data
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/api/capabilities"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|