lattice/docker-compose.yml at master · yarsawyer/lattice · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
services:
  app:
    build: .
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    expose:
      - "3000"
    environment:
      - LATTICE_HOST=0.0.0.0
      - LATTICE_PORT=3000
      - LATTICE_TRUST_PROXY_HEADERS=true
      - RUST_LOG=warn
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/healthz"]
      interval: 15s
      timeout: 3s
      retries: 5
      start_period: 10s

  nginx:
    image: nginx:alpine
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - SETUID
      - SETGID
      - CHOWN
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
      - ./nginx/security-headers.conf:/etc/nginx/conf.d/security-headers.conf:ro
      - certs:/etc/nginx/certs:ro
    depends_on:
      app:
        condition: service_healthy
      certgen:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1/healthz"]
      interval: 15s
      timeout: 3s
      retries: 5
      start_period: 10s

  certgen:
    image: alpine:3.21
    volumes:
      - certs:/certs
    command: >
      sh -c '[ -f /certs/selfsigned.crt ] && exit 0;
      apk add --no-cache openssl &&
      openssl req -x509 -nodes -days 3650 -newkey rsa:2048
      -keyout /certs/selfsigned.key -out /certs/selfsigned.crt
      -subj "/CN=lattice"'

volumes:
  certs: