Реализация на отдельных двух машинах с протестированным взаимодействием по проверке сообщений

VM1_app/codebase/backend/nginx/Dockerfile

@@ -9,6 +9,7 @@ COPY templates /etc/nginx/templates-src/sites
 COPY snippets /etc/nginx/snippets
 COPY scripts/entrypoint.sh /usr/local/bin/han-nginx-entrypoint
 RUN sed -i 's/\r$//' /usr/local/bin/han-nginx-entrypoint \
+    && /bin/sh -n /usr/local/bin/han-nginx-entrypoint \
     && chmod 0555 /usr/local/bin/han-nginx-entrypoint \
     && find /etc/nginx/templates-src /etc/nginx/snippets -type f -exec chmod 0444 {} +
 ENTRYPOINT ["/usr/local/bin/han-nginx-entrypoint"]

VM1_app/codebase/backend/nginx/docker-compose.yml

@@ -1,8 +1,6 @@
 services:
   nginx:
-    build:
-      context: .
-    image: han-chat-nginx:${RELEASE_VERSION:-local}
+    image: ${NGINX_IMAGE:?NGINX_IMAGE must be pinned by digest}
     environment:
       APP_ENV: ${APP_ENV:-production-like}
       PUBLIC_HOST: ${PUBLIC_HOST}
@@ -33,8 +31,8 @@ services:
       - "${NGINX_HTTPS_PORT:-443}:443"
     expose: ["8080"]
     volumes:
-      - nginx-certs:/etc/letsencrypt:ro
-      - nginx-acme-webroot:/var/www/certbot:ro
+      - /var/lib/han-chat/public-tls:/run/tls:ro
+      - /var/lib/han-chat/acme:/var/www/certbot:ro
       - frontend-static:/usr/share/nginx/html:ro
       - nginx-cache:/var/cache/nginx
     networks: [public, backend]
@@ -44,7 +42,6 @@ services:
       keycloak: {condition: service_healthy}
       sms-service: {condition: service_healthy}
       bitrix-local-app: {condition: service_healthy}
-      bitrix-sync: {condition: service_healthy}
     healthcheck:
       test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/nginx-health/live || curl -fsS http://127.0.0.1/nginx-health/live"]
       interval: 10s
@@ -58,6 +55,9 @@ services:
     cap_drop: ["ALL"]
     cap_add: ["CHOWN", "NET_BIND_SERVICE", "SETUID", "SETGID"]
     security_opt: ["no-new-privileges:true"]
+    pids_limit: 256
+    mem_limit: 512m
+    cpus: 1.0
     extra_hosts:
       - "host.docker.internal:host-gateway"
     ulimits:
@@ -65,13 +65,3 @@ services:
     logging:
       driver: json-file
       options: {max-size: "50m", max-file: "5"}
-
-  certbot:
-    image: certbot/certbot:v3.1.0
-    profiles: ["certbot"]
-    volumes:
-      - nginx-certs:/etc/letsencrypt
-      - nginx-acme-webroot:/var/www/certbot
-    networks: [public]
-    security_opt: ["no-new-privileges:true"]
-    cap_drop: ["ALL"]

VM1_app/codebase/backend/nginx/nginx.conf.template

@@ -68,7 +68,6 @@ http {
     upstream keycloak_upstream { server keycloak:8080; keepalive 16; }
     upstream sms_service_upstream { server sms-service:8080; keepalive 8; }
     upstream bitrix_local { server bitrix-local-app:8080; keepalive 16; }
-    upstream bitrix_sync_upstream { server bitrix-sync:8080; keepalive 8; }
     upstream frontend_dev { server ${EXPO_DEV_SERVER_HOSTPORT}; keepalive 8; }
 
     include /etc/nginx/generated/site.conf;