mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
e9f44b8809
Three-stage build: bun compiles the frontend, cargo embeds it into the release binary, and the runtime stage carries only that binary on debian:trixie-slim as an unprivileged user. compose.yml pins DIARY_BIND and DIARY_DATA_DIR over whatever .env says, keeps state in a named volume, publishes on localhost only and probes the port with bash so the image needs no curl. compose.override.yml.example shows the traefik overlay for the personal host.
34 lines
871 B
YAML
34 lines
871 B
YAML
services:
|
|
diary:
|
|
build: .
|
|
image: narl-diary:latest
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
# These win over anything in .env: inside the container the app must
|
|
# listen on all interfaces and keep its state on the volume.
|
|
DIARY_BIND: 0.0.0.0:4242
|
|
DIARY_DATA_DIR: /data
|
|
volumes:
|
|
- diary-data:/data
|
|
networks:
|
|
- internal_net
|
|
ports:
|
|
# Localhost only. Drop this in the override when a reverse proxy
|
|
# reaches the container over its own network instead.
|
|
- "127.0.0.1:4242:4242"
|
|
healthcheck:
|
|
# No extra tooling in the image, so probe the port with bash directly.
|
|
test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/4242"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
start_period: 5s
|
|
retries: 3
|
|
|
|
volumes:
|
|
diary-data:
|
|
|
|
networks:
|
|
internal_net:
|