dido
27f2314c96
- docker-entrypoint.sh: always start both Caddy and Python instead of exiting early for non-root containers; drop Caddy's privileges via gosu (never runs as root); supervise both processes with `wait -n` and tear down the container if either one dies - Caddyfile: add `admin off`; enforce MAX_UPLOAD_SIZE via `request_body max_size` on /api/* instead of relying on an unused env var - docker-compose.yml: use explicit MAX_UPLOAD_SIZE=30MB unit - Dockerfile: merge COPY+chown into a single `COPY --chown` layer for src/; fix HEALTHCHECK Python one-liner (literal \n was causing a SyntaxError on every check, so the container never reported healthy)
49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
services:
|
|
webssh:
|
|
build:
|
|
context: ..
|
|
dockerfile: deployment/Dockerfile
|
|
container_name: webssh-backend
|
|
restart: unless-stopped
|
|
# WebSSH runs internal services; integrated Caddy will expose port 8080 to the host
|
|
ports:
|
|
- "8080:8080"
|
|
environment:
|
|
- TZ=Europe/Sofia
|
|
- PYTHONUNBUFFERED=1
|
|
- LOG_LEVEL=INFO
|
|
# Configure users: format is username:password,username2:password2
|
|
- WEBSSH_USERS=admin:admin
|
|
# Max upload size, enforced by both Caddy and the backend (e.g. "30MB", "512KB")
|
|
- MAX_UPLOAD_SIZE=30MB
|
|
# Session Recording Configuration
|
|
- RECORDING_ENABLED=true
|
|
- RECORDING_RETENTION_DAYS=30
|
|
# Security hardening
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
tmpfs:
|
|
- /tmp:noexec,nosuid,size=100m
|
|
# Resource limits
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1.0'
|
|
memory: 512M
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 128M
|
|
volumes:
|
|
- webssh_data:/data
|
|
# Optionally expose code to other services (read-only)
|
|
# - ./:/srv/webssh:ro
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8080/"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
|
|
volumes:
|
|
webssh_data: |