bvandeusenandClaude Opus 5.5
ed9da56efa
The Syslog page says where to send (this server, its port and protocols) and where the setting is on Synology, QNAP, TrueNAS, OpenWrt, UniFi and rsyslog, open until a device sends. A sender whose address is on Steward's own container network (Swarm ingress publishing hides the real sender) is flagged, with the host-mode ports to publish instead. compose files and the Dockerfile publish 5514/udp and /tcp; docs/plugins/syslog.md describes the plugin and the deploy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
74 lines
3.2 KiB
YAML
74 lines
3.2 KiB
YAML
# Remote deployment — pulls the published :dev image instead of building locally.
|
|
#
|
|
# This is NOT the local-dev compose. `docker-compose.yml` bind-mounts ./steward
|
|
# + ./plugins and runs --debug for live editing; THIS file runs the image as the
|
|
# source of truth (no bind-mounts, no reloader) for a persistent remote instance
|
|
# that tracks the dev CI line.
|
|
#
|
|
# Standup + update runbook: see README → "Remote dev instance".
|
|
|
|
services:
|
|
steward:
|
|
image: git.fabledsword.com/bvandeusen/steward:dev
|
|
container_name: steward
|
|
# Re-pull :dev on every `up` so restarting the stack picks up the latest
|
|
# green dev build without a manual `docker pull`.
|
|
pull_policy: always
|
|
ports:
|
|
- "5000:5000"
|
|
# Syslog (plugins/syslog): devices send here. Steward runs unprivileged,
|
|
# so it listens above 1024; publish 514 to it instead ("514:5514/udp")
|
|
# if a device can't choose its port. Under Docker Swarm use the long form
|
|
# with `mode: host`: Swarm's default ingress publishing hands every packet
|
|
# over from one internal address, and devices are told apart by theirs.
|
|
- "5514:5514/udp"
|
|
- "5514:5514/tcp"
|
|
networks:
|
|
- backend
|
|
volumes:
|
|
# /data holds the auto-generated secret key, third-party plugins, and the
|
|
# Ansible playbook cache — all of which must survive image updates. No
|
|
# source bind-mounts: core + first-party plugins live inside the image.
|
|
#
|
|
# The container runs as the unprivileged 'app' user (uid 1000), so /data
|
|
# MUST be writable by uid 1000. A named docker volume (below) gets that
|
|
# automatically. If you bind-mount a host/NFS path instead, chown it to
|
|
# 1000:1000 (and mind NFS root_squash) — otherwise the app can't persist
|
|
# its secret key, mints a fresh one each boot, and every encrypted secret
|
|
# (managed SSH key, SMTP/OIDC/LDAP creds) becomes unrecoverable. The app
|
|
# now refuses to start in that state rather than silently degrade.
|
|
- app_data:/data
|
|
environment:
|
|
- STEWARD_DATABASE_URL=postgresql+asyncpg://steward:${POSTGRES_PASSWORD:-steward}@db/steward
|
|
# STEWARD_SECRET_KEY is intentionally absent — the app generates a random
|
|
# key on first boot and persists it to /data/secret.key, which the app_data
|
|
# volume keeps across image updates. On multi-node Swarm with a shared bind
|
|
# mount, pin STEWARD_SECRET_KEY (env or a docker secret) instead, so the key
|
|
# never depends on filesystem ownership being correct on every node.
|
|
depends_on:
|
|
- db
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: postgres:16-alpine
|
|
networks:
|
|
- backend
|
|
environment:
|
|
POSTGRES_USER: steward
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-steward}
|
|
POSTGRES_DB: steward
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
# No host port published — db is reachable only on the backend network.
|
|
# No healthcheck: a slow disk (NFS) failed pg_isready and the orchestrator
|
|
# killed a healthy database mid-write (#5275). Steward waits for the
|
|
# database itself, at startup and per request (steward/database.py).
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
backend:
|
|
|
|
volumes:
|
|
pgdata:
|
|
app_data:
|