ElebobaandClaude Opus 5.5
55286495cb
CI / ruff · mypy · pytest (pull_request) Successful in 1m11s
- docker-socket-proxy в Compose (только GET /containers/*), сокет только у него - app/runtime/docker.py: read-only клиент; видны только контейнеры с меткой tgit.managed=true, чужие id отклоняются до запроса - app/runtime/checks.py: running, health, рестарты за окно, CPU/RAM, ошибки в логе, HTTP-проба; у каждой проверки свой таймаут, отчёт всегда полный - app/runtime/snapshots.py: снапшоты раз в 15 с в container_snapshots - бот: список с 🟢🟡🔴⚪, карточка, «🩺 Запустить проверки», «🔄 Обновить» - деплой ставит метки tgit.sha / tgit.deployed_at на контейнер бота - имя джоба CD без неотрисованного выражения Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
65 lines
1.9 KiB
YAML
65 lines
1.9 KiB
YAML
# Local / any-host stack: `make up`. Server overrides — infra/deploy/docker-compose.server.yml (#12).
|
|
services:
|
|
bot:
|
|
build: .
|
|
env_file: .env
|
|
environment:
|
|
DATABASE_URL: postgresql+asyncpg://tgit:${POSTGRES_PASSWORD:-tgit}@postgres:5432/tgit
|
|
GIT_CLONE_DIR: /data/uploads
|
|
DOCKER_URL: http://docker-proxy:2375
|
|
volumes:
|
|
- uploads:/data
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
docker-proxy:
|
|
condition: service_started
|
|
restart: unless-stopped
|
|
mem_limit: 384m # ~190 MB idle; git clone/push and aiogram spikes need headroom
|
|
labels:
|
|
tgit.managed: "true"
|
|
# Shown on the «Статус» card; infra/deploy/remote.sh sets both, a local `make up` leaves them empty
|
|
tgit.sha: ${TGIT_SHA:-}
|
|
tgit.deployed_at: ${TGIT_DEPLOYED_AT:-}
|
|
logging:
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: tgit
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-tgit}
|
|
POSTGRES_DB: tgit
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U tgit -d tgit"]
|
|
interval: 3s
|
|
timeout: 3s
|
|
retries: 20
|
|
restart: unless-stopped
|
|
mem_limit: 256m
|
|
labels:
|
|
tgit.managed: "true"
|
|
logging:
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
# The only holder of the Docker socket: GET on /containers/* and nothing else (ADR-006). The bot never sees the socket.
|
|
docker-proxy:
|
|
image: tecnativa/docker-socket-proxy:0.3.0
|
|
environment:
|
|
CONTAINERS: 1 # list, inspect, stats, logs
|
|
POST: 0 # no create/start/stop/exec — restarts go through tgit-runner (#13)
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
restart: unless-stopped
|
|
mem_limit: 64m
|
|
labels:
|
|
tgit.managed: "true"
|
|
logging:
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
volumes:
|
|
pgdata:
|
|
uploads:
|