Lucas WintherandClaude Opus 5
b76c76e3b0
The files copied to /srv/stacks/<stack>/ verbatim: compose files, vhosts, Prometheus configuration, the webapp image source. Payloads are data, never templated and never linted as Ansible content. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
# The public entry point. nginx-proxy watches the Docker socket and writes a
|
|
# vhost for every container that sets VIRTUAL_HOST; acme-companion requests and
|
|
# renews the certificate for every LETSENCRYPT_HOST.
|
|
#
|
|
# Two things about this stack drive decisions elsewhere in the repository:
|
|
#
|
|
# - proxy-net is external. Every stack that wants to be reachable joins it, so
|
|
# something has to create it before any of them start. That is stack_networks
|
|
# in the role, and it is why site.yml deploys this stack first.
|
|
# - conf/, vhost/ and html/ are bind mounts holding plain files. Editing one
|
|
# changes nothing until nginx reloads, because Compose sees an unchanged
|
|
# compose file and does not recreate the container. That is what
|
|
# compose_stack_synced and the post_tasks reload are for.
|
|
services:
|
|
reverse-proxy:
|
|
container_name: reverse-proxy
|
|
image: nginxproxy/nginx-proxy:1.6
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./proxy-data/conf:/etc/nginx/conf.d
|
|
- ./proxy-data/vhost:/etc/nginx/vhost.d
|
|
- ./proxy-data/html:/usr/share/nginx/html
|
|
- ./proxy-data/dhparam:/etc/nginx/dhparam
|
|
- ./proxy-data/certs:/etc/nginx/certs:ro
|
|
- /var/run/docker.sock:/tmp/docker.sock:ro
|
|
networks:
|
|
- proxy-net
|
|
|
|
acme-companion:
|
|
container_name: reverse-proxy-acme
|
|
image: nginxproxy/acme-companion:2.4
|
|
restart: unless-stopped
|
|
volumes_from:
|
|
- reverse-proxy
|
|
volumes:
|
|
- ./proxy-data/certs:/etc/nginx/certs
|
|
- ./proxy-data/acme:/etc/acme.sh
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
environment:
|
|
# Let's Encrypt sends expiry warnings here.
|
|
DEFAULT_EMAIL: [email protected]
|
|
networks:
|
|
- proxy-net
|
|
|
|
networks:
|
|
proxy-net:
|
|
external: true
|