personal_infra/ansible/roles/gatus/templates/docker-compose.yml.j2

# Managed by Ansible (roles/gatus)
services:
  gatus:
    image: {{ gatus_image }}
    container_name: gatus
    restart: unless-stopped

    # The image is FROM scratch: no /etc/passwd, so there is no user to drop to
    # by name and the default is root. Run it by numeric id instead.
    user: "{{ gatus_uid }}:{{ gatus_gid }}"

    ports:
      # Loopback on purpose. Caddy fronts this, and the external-endpoint push
      # API is served from the same listener as the dashboard - publishing
      # 0.0.0.0 would put both straight on the public internet.
      - "{{ gatus_bind_address }}:{{ gatus_port }}:{{ gatus_port }}"

    environment:
      GATUS_CONFIG_PATH: /config
      GATUS_LOG_LEVEL: "{{ gatus_log_level }}"

    volumes:
      - {{ gatus_config_dir }}:/config:ro
      - {{ gatus_data_dir }}:/data

    # Hardening. The systemd unit this replaced got most of it from
    # ProtectSystem/NoNewPrivileges/etc; these are the container equivalents.
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
{% if gatus_allow_icmp %}
    cap_add:
      # icmp:// endpoints need raw sockets. Dropped above with ALL, added back
      # explicitly so the grant is visible rather than inherited from root.
      - NET_RAW
{% endif %}

    networks:
      # Shared with signal-api, so alerts can be delivered by service name.
      # 127.0.0.1 inside this container is the container, not the host.
      - {{ gatus_network }}

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

networks:
  {{ gatus_network }}:
    external: true