Sergei Poljanski
b6bcc9f882
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
The public bingo site is moving out of the asxpio container and only needs to read the bingo tables and the bingo/ photos. Give it a role limited to SELECT on those two tables (with read-only transactions by default) and a MinIO user limited to GetObject under asxpio-invoices/bingo/, instead of reusing asxpio's read-write credentials. Both steps are skipped while the BINGO_* secrets are unset, so this deploys safely before they exist. Tables missing on a fresh install are granted on the next deploy. Assisted-by: Claude:opus-5
96 lines
2.6 KiB
YAML
96 lines
2.6 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
container_name: storage-postgres
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: postgres
|
|
volumes:
|
|
- pg_data:/var/lib/postgresql/data
|
|
networks:
|
|
- storage
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
postgres-init:
|
|
image: postgres:17-alpine
|
|
container_name: storage-postgres-init
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
PGHOST: postgres
|
|
PGUSER: postgres
|
|
PGPASSWORD: ${POSTGRES_PASSWORD}
|
|
ASXPIO_DB_PASSWORD: ${ASXPIO_DB_PASSWORD}
|
|
BINGO_DB_PASSWORD: ${BINGO_DB_PASSWORD}
|
|
volumes:
|
|
- ./init/postgres-init.sh:/init.sh:ro
|
|
entrypoint: ["/bin/sh", "/init.sh"]
|
|
networks:
|
|
- storage
|
|
restart: "no"
|
|
|
|
minio:
|
|
image: minio/minio:latest
|
|
container_name: storage-minio
|
|
restart: unless-stopped
|
|
command: server /data --console-address ":9001"
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
|
|
MINIO_BROWSER_REDIRECT_URL: https://s3.asxp.io
|
|
volumes:
|
|
- minio_data:/data
|
|
networks:
|
|
- storage
|
|
- traefik
|
|
healthcheck:
|
|
test: ["CMD", "mc", "ready", "local"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik"
|
|
- "traefik.http.routers.minio-s3.rule=Host(`s3.asxp.io`)"
|
|
- "traefik.http.routers.minio-s3.entrypoints=websecure"
|
|
- "traefik.http.routers.minio-s3.tls=true"
|
|
- "traefik.http.routers.minio-s3.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.minio-s3.service=minio-s3"
|
|
- "traefik.http.services.minio-s3.loadbalancer.server.port=9000"
|
|
|
|
minio-init:
|
|
image: minio/mc:latest
|
|
container_name: storage-minio-init
|
|
depends_on:
|
|
minio:
|
|
condition: service_healthy
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
|
|
ASXPIO_S3_ACCESS_KEY: ${ASXPIO_S3_ACCESS_KEY}
|
|
ASXPIO_S3_SECRET_KEY: ${ASXPIO_S3_SECRET_KEY}
|
|
BINGO_S3_ACCESS_KEY: ${BINGO_S3_ACCESS_KEY}
|
|
BINGO_S3_SECRET_KEY: ${BINGO_S3_SECRET_KEY}
|
|
volumes:
|
|
- ./init/minio-bootstrap.sh:/bootstrap.sh:ro
|
|
entrypoint: ["/bin/sh", "/bootstrap.sh"]
|
|
networks:
|
|
- storage
|
|
restart: "no"
|
|
|
|
volumes:
|
|
pg_data:
|
|
minio_data:
|
|
|
|
networks:
|
|
storage:
|
|
name: storage
|
|
traefik:
|
|
external: true
|