mi
59 lines
2.0 KiB
YAML
59 lines
2.0 KiB
YAML
services:
|
|
message-safety:
|
|
build: .
|
|
image: han/message-safety:${MESSAGE_SAFETY_IMAGE_TAG}
|
|
command: ["message-safety"]
|
|
user: "10001:10001"
|
|
read_only: true
|
|
init: true
|
|
restart: unless-stopped
|
|
expose: ["8080"]
|
|
env_file:
|
|
- /etc/han-chat/message-safety-bootstrap.env
|
|
- /etc/han-chat/message-safety-mode.env
|
|
environment:
|
|
MESSAGE_SAFETY_PROCESS_ROLE: api
|
|
MESSAGE_SAFETY_DATABASE_URL_FILE: /run/secrets/database_url
|
|
MESSAGE_SAFETY_REDIS_URL_FILE: /run/secrets/redis_url
|
|
MESSAGE_SAFETY_SERVICE_TOKEN_FILE: /run/secrets/service_token
|
|
secrets: [database_url, redis_url, service_token]
|
|
tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=64m"]
|
|
security_opt: ["no-new-privileges:true"]
|
|
cap_drop: [ALL]
|
|
pids_limit: 128
|
|
mem_limit: 512m
|
|
cpus: 1.0
|
|
networks: [backend, observability]
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live', timeout=2)"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 3
|
|
|
|
message-safety-worker:
|
|
image: han/message-safety:${MESSAGE_SAFETY_IMAGE_TAG}
|
|
command: ["message-safety-worker"]
|
|
user: "10001:10001"
|
|
read_only: true
|
|
init: true
|
|
restart: unless-stopped
|
|
env_file:
|
|
- /etc/han-chat/message-safety-bootstrap.env
|
|
- /etc/han-chat/message-safety-mode.env
|
|
environment:
|
|
MESSAGE_SAFETY_PROCESS_ROLE: worker
|
|
MESSAGE_SAFETY_DATABASE_URL_FILE: /run/secrets/database_url
|
|
MESSAGE_SAFETY_REDIS_URL_FILE: /run/secrets/redis_url
|
|
SELECTEL_S3_QUARANTINE_READ_ACCESS_KEY_FILE: /run/secrets/s3_access_key
|
|
SELECTEL_S3_QUARANTINE_READ_SECRET_KEY_FILE: /run/secrets/s3_secret_key
|
|
secrets: [database_url, redis_url, s3_access_key, s3_secret_key]
|
|
tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=64m"]
|
|
security_opt: ["no-new-privileges:true"]
|
|
cap_drop: [ALL]
|
|
pids_limit: 256
|
|
mem_limit: 1536m
|
|
cpus: 2.0
|
|
networks: [backend, egress, observability]
|
|
|
|
# Root VM2 Compose owns these secret mappings and networks.
|