init

docker-compose.yml

@@ -0,0 +1,45 @@
+services:
+  app:
+    build:
+      context: .
+    container_name: update-server
+    image: update-server:latest
+    restart: unless-stopped
+    init: true
+    ports:
+      - "127.0.0.1:8080:8080"
+    environment:
+      APP_ADDR: "0.0.0.0:8080"
+      APP_BASE_URL: "${APP_BASE_URL:?set APP_BASE_URL to the public HTTPS URL}"
+      DATA_DIR: "/data"
+      SQLITE_PATH: "/data/db.sqlite"
+      ARTIFACTS_DIR: "/data/artifacts"
+      MIGRATIONS_DIR: "/app/migrations"
+      TEMPLATES_DIR: "/app/web/templates"
+      STATIC_DIR: "/app/web/static"
+      TRUST_PROXY_HEADERS: "true"
+      ADMIN_EMAIL: "${ADMIN_EMAIL:?set ADMIN_EMAIL}"
+      ADMIN_PASSWORD: "${ADMIN_PASSWORD:?set ADMIN_PASSWORD}"
+      APP_LOG_LEVEL: "${APP_LOG_LEVEL:-INFO}"
+      APP_READ_TIMEOUT: "${APP_READ_TIMEOUT:-30s}"
+      APP_READ_HEADER_TIMEOUT: "${APP_READ_HEADER_TIMEOUT:-5s}"
+      APP_WRITE_TIMEOUT: "${APP_WRITE_TIMEOUT:-60s}"
+      APP_IDLE_TIMEOUT: "${APP_IDLE_TIMEOUT:-120s}"
+      APP_MAX_HEADER_BYTES: "${APP_MAX_HEADER_BYTES:-1048576}"
+      APP_LOGIN_RATE_LIMIT_PER_MINUTE: "${APP_LOGIN_RATE_LIMIT_PER_MINUTE:-10}"
+      APP_LOGIN_RATE_LIMIT_BURST: "${APP_LOGIN_RATE_LIMIT_BURST:-5}"
+      APP_CLIENT_RATE_LIMIT_PER_MINUTE: "${APP_CLIENT_RATE_LIMIT_PER_MINUTE:-120}"
+      APP_CLIENT_RATE_LIMIT_BURST: "${APP_CLIENT_RATE_LIMIT_BURST:-60}"
+    volumes:
+      - update-server-data:/data
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+volumes:
+  update-server-data:
+