bvandeusenandClaude Opus 5.5
18032a4782
Docker02's Sunday job updated and rebooted, then failed only because portal_app was short of its replica past the 30-minute settle. Its maintenance_failed figure stayed 1, and the alert kept firing, until a later job succeeds. A job failed for not coming back into service is checked again each minute and reads 0 once the host is back; a failed or timed-out update still reads 1 until a job succeeds. Also: compose.deploy.yml's syslog comment still said devices are told apart by address under Swarm (stale since #6096). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
75 lines
3.2 KiB
YAML
75 lines
3.2 KiB
YAML
# Remote deployment — pulls the published :dev image instead of building locally.
|
|
#
|
|
# This is NOT the local-dev compose. `docker-compose.yml` bind-mounts ./steward
|
|
# + ./plugins and runs --debug for live editing; THIS file runs the image as the
|
|
# source of truth (no bind-mounts, no reloader) for a persistent remote instance
|
|
# that tracks the dev CI line.
|
|
#
|
|
# Standup + update runbook: see README → "Remote dev instance".
|
|
|
|
services:
|
|
steward:
|
|
image: git.fabledsword.com/bvandeusen/steward:dev
|
|
container_name: steward
|
|
# Re-pull :dev on every `up` so restarting the stack picks up the latest
|
|
# green dev build without a manual `docker pull`.
|
|
pull_policy: always
|
|
ports:
|
|
- "5000:5000"
|
|
# Syslog (plugins/syslog): devices send here. Steward runs unprivileged,
|
|
# so it listens above 1024; publish 514 to it instead ("514:5514/udp")
|
|
# if a device can't choose its port. Under Docker Swarm's ingress every
|
|
# device arrives from one internal address and is told apart by the name
|
|
# its lines carry; the long form with `mode: host` keeps each device's
|
|
# own address but ties Steward to that node.
|
|
- "5514:5514/udp"
|
|
- "5514:5514/tcp"
|
|
networks:
|
|
- backend
|
|
volumes:
|
|
# /data holds the auto-generated secret key, third-party plugins, and the
|
|
# Ansible playbook cache — all of which must survive image updates. No
|
|
# source bind-mounts: core + first-party plugins live inside the image.
|
|
#
|
|
# The container runs as the unprivileged 'app' user (uid 1000), so /data
|
|
# MUST be writable by uid 1000. A named docker volume (below) gets that
|
|
# automatically. If you bind-mount a host/NFS path instead, chown it to
|
|
# 1000:1000 (and mind NFS root_squash) — otherwise the app can't persist
|
|
# its secret key, mints a fresh one each boot, and every encrypted secret
|
|
# (managed SSH key, SMTP/OIDC/LDAP creds) becomes unrecoverable. The app
|
|
# now refuses to start in that state rather than silently degrade.
|
|
- app_data:/data
|
|
environment:
|
|
- STEWARD_DATABASE_URL=postgresql+asyncpg://steward:${POSTGRES_PASSWORD:-steward}@db/steward
|
|
# STEWARD_SECRET_KEY is intentionally absent — the app generates a random
|
|
# key on first boot and persists it to /data/secret.key, which the app_data
|
|
# volume keeps across image updates. On multi-node Swarm with a shared bind
|
|
# mount, pin STEWARD_SECRET_KEY (env or a docker secret) instead, so the key
|
|
# never depends on filesystem ownership being correct on every node.
|
|
depends_on:
|
|
- db
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
image: postgres:16-alpine
|
|
networks:
|
|
- backend
|
|
environment:
|
|
POSTGRES_USER: steward
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-steward}
|
|
POSTGRES_DB: steward
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
# No host port published — db is reachable only on the backend network.
|
|
# No healthcheck: a slow disk (NFS) failed pg_isready and the orchestrator
|
|
# killed a healthy database mid-write (#5275). Steward waits for the
|
|
# database itself, at startup and per request (steward/database.py).
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
backend:
|
|
|
|
volumes:
|
|
pgdata:
|
|
app_data:
|