Helix/compose.yaml at main · Riqqqque/Helix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: ${COMPOSE_PROJECT_NAME:-server-dashboard}

x-common: &common
  restart: unless-stopped
  init: true
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL
  logging:
    driver: json-file
    options:
      max-size: "10m"
      max-file: "3"
  labels:
    com.centurylinklabs.watchtower.enable: "false"

services:
  dashboard:
    <<: *common
    container_name: server-dashboard
    image: helix-dashboard:${HELIX_IMAGE_TAG:-local}
    build:
      context: .
      target: dashboard
      args:
        HELIX_SOURCE_REVISION: ${HELIX_SOURCE_REVISION:-unknown}
    read_only: true
    stop_grace_period: 30s
    environment:
      RUST_LOG: helixd=info,tower_http=warn
      HELIX_PRIVD_SOCKET: /run/helix-host/privd.sock
      HELIX_TERMINAL_SOCKET: /run/helix-host/terminal/terminal.sock
      # Password proofs are intentionally memory-hard. Keep glibc from retaining
      # a separate arena after each short-lived blocking worker exits.
      MALLOC_ARENA_MAX: "1"
      MALLOC_MMAP_THRESHOLD_: "131072"
      MALLOC_TRIM_THRESHOLD_: "131072"
    group_add:
      - ${HELIX_BROKER_GID:?set HELIX_BROKER_GID in .env}
      - ${HELIX_TERMINAL_GID:?set HELIX_TERMINAL_GID in .env}
    volumes:
      - type: bind
        source: ${HELIX_DATA_DIR:-./data}
        target: /var/lib/helix
        bind:
          create_host_path: false
      - type: bind
        source: ${HELIX_BACKUP_DIR:-./backups}
        target: /var/lib/helix-backups
        bind:
          create_host_path: false
      - type: bind
        source: /run/helix
        target: /run/helix-host
        read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777
    ports:
      - name: dashboard-lan
        target: 3000
        published: ${HELIX_LAN_PORT:-3100}
        host_ip: ${HELIX_LAN_BIND_ADDRESS:?set HELIX_LAN_BIND_ADDRESS in .env}
        protocol: tcp
        app_protocol: http
    networks:
      - helix-private
    healthcheck:
      test:
        - CMD
        - /app/bin/helixctl
        - --config
        - /app/config/helix.toml
        - ready
        - --timeout-seconds
        - "3"
      interval: 15s
      timeout: 5s
      retries: 6
      start_period: 30s
    mem_limit: 128m
    cpus: 1.0
    pids_limit: 128

  gateway:
    <<: *common
    container_name: server-dashboard-gateway
    image: helix-dashboard-gateway:${HELIX_IMAGE_TAG:-local}
    build:
      context: .
      target: gateway
      args:
        HELIX_SOURCE_REVISION: ${HELIX_SOURCE_REVISION:-unknown}
    network_mode: service:dashboard
    depends_on:
      dashboard:
        condition: service_healthy
        restart: true
    read_only: true
    stop_grace_period: 10s
    environment:
      HELIX_GATEWAY_HOST: ${HELIX_GATEWAY_HOST:?set HELIX_GATEWAY_HOST in .env}
      HELIX_BROWSER_ORIGIN: ${HELIX_BROWSER_ORIGIN:?set HELIX_BROWSER_ORIGIN in .env}
      HELIX_ALLOWED_CLIENT_CIDR: ${HELIX_ALLOWED_CLIENT_CIDR:?set HELIX_ALLOWED_CLIENT_CIDR in .env}
      HELIX_SECONDARY_GATEWAY_HOST: ${HELIX_SECONDARY_GATEWAY_HOST:?set HELIX_SECONDARY_GATEWAY_HOST in .env}
      HELIX_SECONDARY_BROWSER_ORIGIN: ${HELIX_SECONDARY_BROWSER_ORIGIN:?set HELIX_SECONDARY_BROWSER_ORIGIN in .env}
      HELIX_SECONDARY_ALLOWED_CLIENT_CIDR: ${HELIX_SECONDARY_ALLOWED_CLIENT_CIDR:?set HELIX_SECONDARY_ALLOWED_CLIENT_CIDR in .env}
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777
      - /etc/nginx/conf.d:rw,noexec,nosuid,nodev,size=1m,uid=101,gid=101,mode=0755
    healthcheck:
      test:
        - CMD-SHELL
        - >-
          wget -q -O /dev/null --header="Host: $${HELIX_GATEWAY_HOST}"
          http://127.0.0.1:3000/gateway-healthz
      interval: 15s
      timeout: 5s
      retries: 6
      start_period: 10s
    mem_limit: 64m
    cpus: 0.5
    pids_limit: 64

networks:
  helix-private:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.enable_icc: "false"