45 lines
1.3 KiB
Text
45 lines
1.3 KiB
Text
|
# Managed by Ansible (roles/gatus)
|
||
|
|
services:
|
||
|
|
gatus:
|
||
|
|
image: {{ gatus_image }}
|
||
|
|
container_name: gatus
|
||
|
|
restart: unless-stopped
|
||
|
|
|
||
|
|
# The image is FROM scratch: no /etc/passwd, so there is no user to drop to
|
||
|
|
# by name and the default is root. Run it by numeric id instead.
|
||
|
|
user: "{{ gatus_uid }}:{{ gatus_gid }}"
|
||
|
|
|
||
|
|
ports:
|
||
|
|
# Loopback on purpose. Caddy fronts this, and the external-endpoint push
|
||
|
|
# API is served from the same listener as the dashboard - publishing
|
||
|
|
# 0.0.0.0 would put both straight on the public internet.
|
||
|
|
- "{{ gatus_bind_address }}:{{ gatus_port }}:{{ gatus_port }}"
|
||
|
|
|
||
|
|
environment:
|
||
|
|
GATUS_CONFIG_PATH: /config
|
||
|
|
GATUS_LOG_LEVEL: "{{ gatus_log_level }}"
|
||
|
|
|
||
|
|
volumes:
|
||
|
|
- {{ gatus_config_dir }}:/config:ro
|
||
|
|
- {{ gatus_data_dir }}:/data
|
||
|
|
|
||
|
|
# Hardening. The systemd unit this replaced got most of it from
|
||
|
|
# ProtectSystem/NoNewPrivileges/etc; these are the container equivalents.
|
||
|
|
read_only: true
|
||
|
|
security_opt:
|
||
|
|
- no-new-privileges:true
|
||
|
|
cap_drop:
|
||
|
|
- ALL
|
||
|
|
{% if gatus_allow_icmp %}
|
||
|
|
cap_add:
|
||
|
|
# icmp:// endpoints need raw sockets. Dropped above with ALL, added back
|
||
|
|
# explicitly so the grant is visible rather than inherited from root.
|
||
|
|
- NET_RAW
|
||
|
|
{% endif %}
|
||
|
|
|
||
|
|
logging:
|
||
|
|
driver: json-file
|
||
|
|
options:
|
||
|
|
max-size: "10m"
|
||
|
|
max-file: "3"
|