jacobh2
7fb86f5524
- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. - Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs 0750 1000:1000 and Caddy's /data to 10002. - deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests, warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs only write:package. - Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted read-only at /secrets. - README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks, APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
88 lines
3.3 KiB
YAML
88 lines
3.3 KiB
YAML
# Kvitt development stack on the owner's Mac (SPEC §10 "Development first", D-001).
|
|
# Not the Pi stack: that is infra/pi/compose.yaml (D-103).
|
|
#
|
|
# No Caddy and no TLS here: debug builds accept http:// to private LAN addresses (AC-2.8), so the
|
|
# server publishes its own port on the Mac. Release builds never talk to this stack.
|
|
#
|
|
# Use the scripts next to this file (see infra/README.md):
|
|
# infra/dev/build.sh build kvitt-server:dev (from server/Dockerfile) and kvitt-backup:dev
|
|
# infra/dev/up.sh start the server, wait for /health, print the LAN URL
|
|
# infra/dev/logs.sh follow the logs
|
|
# infra/dev/backup.sh run the backup job once (local snapshot, no Drive upload)
|
|
# Relative paths below resolve against this directory (infra/dev/).
|
|
|
|
name: kvitt-dev
|
|
|
|
x-logging: &logging
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
services:
|
|
server:
|
|
image: ${KVITT_SERVER_IMAGE:-kvitt-server:dev}
|
|
command: ["serve"]
|
|
restart: unless-stopped
|
|
user: "10001:10001"
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 160m
|
|
ports:
|
|
# The only published port of the dev stack; reachable from the phone on the home Wi-Fi.
|
|
- "${KVITT_DEV_PORT:-8080}:8080"
|
|
environment:
|
|
TZ: Europe/Stockholm
|
|
KVITT_DATA_DIR: /data
|
|
KVITT_BIND: 0.0.0.0:8080
|
|
# Invite links and the landing page point here; up.sh fills it from the Mac's LAN address when empty.
|
|
KVITT_PUBLIC_URL: ${KVITT_PUBLIC_URL:-http://localhost:8080}
|
|
KVITT_FCM_CREDENTIALS: /secrets/fcm-service-account.json
|
|
KVITT_FCM_PROJECT_ID: ${KVITT_FCM_PROJECT_ID:-kvitt-1337}
|
|
RUST_LOG: ${RUST_LOG:-info}
|
|
volumes:
|
|
# SQLite database, pictures and APKs: a bind-mounted folder on the Mac (git-ignored).
|
|
- ${KVITT_DEV_DATA_DIR:-./data}:/data
|
|
# Only the FCM key, read-only (D-117): up.sh copies ${KVITT_SECRETS_DIR}/fcm-service-account.json into
|
|
# infra/dev/secrets/ (git-ignored), which holds nothing else. A folder is mounted rather than the file, because
|
|
# a missing source file would make Docker create a directory in its place, while a missing key must simply
|
|
# leave push disabled with a start-up warning (§10.4); without the key the folder is empty.
|
|
- ./secrets:/secrets:ro
|
|
healthcheck:
|
|
test: ["CMD", "kvitt-server", "healthcheck"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
logging: *logging
|
|
networks: [kvitt]
|
|
|
|
backup:
|
|
image: ${KVITT_BACKUP_IMAGE:-kvitt-backup:dev}
|
|
# On demand only: `docker compose run --rm backup /backup.sh` (infra/dev/backup.sh). `up` skips it.
|
|
profiles: [backup]
|
|
command: ["/backup.sh"]
|
|
restart: "no"
|
|
# Same uid as the server, so it can open the WAL database files the server owns.
|
|
user: "10001:10001"
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 96m
|
|
environment:
|
|
TZ: Europe/Stockholm
|
|
# Empty on the dev stack: the Drive upload is skipped and the local files are kept (§10.9, D-001), so
|
|
# backup.sh reads no other rclone setting here.
|
|
RCLONE_FOLDER_ID: ""
|
|
volumes:
|
|
- ${KVITT_DEV_DATA_DIR:-./data}:/data
|
|
- ${KVITT_DEV_BACKUP_DIR:-./backups}:/backups
|
|
logging: *logging
|
|
networks: [kvitt]
|
|
|
|
networks:
|
|
kvitt:
|
|
driver: bridge
|