58 lines
3.2 KiB
YAML
58 lines
3.2 KiB
YAML
|
---
|
||
|
|
# Jar Lid Archive: Django (gunicorn) + Postgres + SeaweedFS (S3) as one compose
|
||
|
|
# stack. Source and CI live in forgejo.contrapeso.xyz/counterweight/jar-lid-archive.
|
||
|
|
#
|
||
|
|
# Per-deployment values (domain, port, retention) live in the host's host_vars,
|
||
|
|
# because the Caddy play on the edge host and the backup plays read them too and
|
||
|
|
# a role default cannot reach a second play.
|
||
|
|
|
||
|
|
jar_lid_archive_dir: /opt/jar-lid-archive
|
||
|
|
|
||
|
|
# ── Images ───────────────────────────────────────────────────────────────────
|
||
|
|
# The app follows a moving tag on purpose: every run pulls it, and compose
|
||
|
|
# recreates `web` only when the digest actually changed. CI pushes :master on
|
||
|
|
# every green build of master, plus :<sha>.
|
||
|
|
jar_lid_archive_image: forgejo.contrapeso.xyz/counterweight/jar-lid-archive
|
||
|
|
jar_lid_archive_image_tag: master
|
||
|
|
|
||
|
|
# Pinned to what the app's own compose.yaml and CI run, so staging rehearses the
|
||
|
|
# same stack. Bump them together with the app repo, not separately.
|
||
|
|
jar_lid_archive_postgres_image: "postgres:18"
|
||
|
|
jar_lid_archive_seaweedfs_image: "chrislusf/seaweedfs:4.47"
|
||
|
|
|
||
|
|
# Registry login. Empty = pull anonymously, which works today: the package is
|
||
|
|
# owner-scoped in Forgejo and public even though the repository is private.
|
||
|
|
jar_lid_archive_registry: forgejo.contrapeso.xyz
|
||
|
|
jar_lid_archive_registry_user: ""
|
||
|
|
jar_lid_archive_registry_token: ""
|
||
|
|
|
||
|
|
# ── Networking ───────────────────────────────────────────────────────────────
|
||
|
|
# gunicorn listens on the HOST network on this port. See the README for why host
|
||
|
|
# networking rather than a published port: Docker's published ports bypass UFW.
|
||
|
|
jar_lid_archive_port: 8000
|
||
|
|
# Loopback-only ports for the two backing services, so the web container (on the
|
||
|
|
# host network) can reach them and nothing else can.
|
||
|
|
jar_lid_archive_postgres_port: 5432
|
||
|
|
jar_lid_archive_s3_port: 8333
|
||
|
|
|
||
|
|
jar_lid_archive_domain: "" # e.g. jars-staging.contrapeso.xyz
|
||
|
|
|
||
|
|
# ── App settings ─────────────────────────────────────────────────────────────
|
||
|
|
jar_lid_archive_postgres_db: jarlid
|
||
|
|
jar_lid_archive_postgres_user: jarlid
|
||
|
|
jar_lid_archive_s3_access_key: jarlid
|
||
|
|
jar_lid_archive_s3_bucket: photos
|
||
|
|
|
||
|
|
# Secrets: pass from the vault. The assert in tasks/deploy.yml refuses empties.
|
||
|
|
jar_lid_archive_django_secret_key: ""
|
||
|
|
jar_lid_archive_postgres_password: ""
|
||
|
|
jar_lid_archive_s3_secret_key: ""
|
||
|
|
|
||
|
|
# ── Seed users ───────────────────────────────────────────────────────────────
|
||
|
|
# Loaded with `manage.py seed_users -` on every run. That command RESETS each
|
||
|
|
# listed user's password and flags, so the vault stays the source of truth.
|
||
|
|
# Same usernames as the app's tests/fixtures/users.json, never its passwords:
|
||
|
|
# this deployment is reachable from the internet.
|
||
|
|
# - {username: alice, password: "...", email: "...", is_superuser: false}
|
||
|
|
jar_lid_archive_seed_users: []
|