60 lines
2.3 KiB
YAML
60 lines
2.3 KiB
YAML
networks:
|
|
ems-internal:
|
|
driver: bridge
|
|
|
|
services:
|
|
|
|
# ── Traefik ─────────────────────────────────────────────────────────────────
|
|
# TLS termination + mTLS on port 9443.
|
|
# Perimeter firewall forwards external TCP 9443 → Synology:9443.
|
|
# Only connections presenting a client cert signed by /certs/ca.crt are forwarded.
|
|
traefik:
|
|
image: traefik:v3.1
|
|
restart: unless-stopped
|
|
ports:
|
|
- "9443:9443" # HTTPS + mTLS — open on perimeter firewall
|
|
- "127.0.0.1:8082:8082" # Traefik ping — LAN only, never expose externally
|
|
volumes:
|
|
- ./infra/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
|
|
- ./infra/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
|
|
# Certs: ca.crt, server.crt, server.key (generated by infra/ca/ scripts)
|
|
- /etc/ems/certs:/certs:ro
|
|
networks:
|
|
- ems-internal
|
|
depends_on:
|
|
- ems
|
|
|
|
# ── EMS ─────────────────────────────────────────────────────────────────────
|
|
# Web UI is NOT exposed externally — Traefik proxies to :9099 internally.
|
|
# Prometheus metrics on :9101 stay LAN-accessible for the existing scrape job.
|
|
#
|
|
# Image source:
|
|
# CI deploy: EMS_IMAGE=192.168.0.234:8765/owner/ems:sha docker compose up -d ems
|
|
# Local dev: docker compose up --build
|
|
ems:
|
|
image: ${EMS_IMAGE:-ems:latest}
|
|
build: .
|
|
restart: unless-stopped
|
|
ports:
|
|
# Metrics — Prometheus scrape from LAN (192.168.0.23:9090)
|
|
# Do NOT route through Traefik (no auth on metrics endpoint by design).
|
|
- "9101:9101"
|
|
volumes:
|
|
# Config (read-only) — must be chmod 600
|
|
- /etc/ems:/etc/ems:ro
|
|
# Persistent state: trip goals, sessions, auth tokens
|
|
- /var/lib/ems:/var/lib/ems
|
|
# Heartbeat file
|
|
- /run/ems:/run/ems
|
|
networks:
|
|
- ems-internal
|
|
environment:
|
|
- TZ=Europe/Berlin
|
|
|
|
# Health check using the unauthenticated /health endpoint
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:9099/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|