orchard

 1name: orchard-auth
 2
 3# No published ports. /verify is reachable by container name on the shared
 4# network and Caddy refuses it on the public hostname, which is what makes the
 5# cookie in the request the only credential the other sites need to forward.
 6
 7services:
 8  app:
 9    build:
10      context: .
11      dockerfile: Dockerfile
12    container_name: orchard-auth
13    restart: unless-stopped
14    # Longer than Docker's 10s default, because shutdown drains the log shipper
15    # queue. Without it a slow drain means SIGKILL and a skipped db.Close().
16    stop_grace_period: 30s
17    environment:
18      # Read from .env in this directory, which compose picks up as the project
19      # directory. Empty is tolerated and logged: refusing to start without it
20      # would mean a bad ntfy token locks the operator out of everything at
21      # once, and recovery codes still work.
22      AUTH_NTFY_TOKEN: ${AUTH_NTFY_TOKEN:-}
23      # What makes one login cover every bythewood.me host. Set to the parent
24      # domain in production and left empty in development, since a cookie
25      # scoped to .bythewood.me is never sent to localhost.
26      SESSION_DOMAIN: ${SESSION_DOMAIN:-.bythewood.me}
27    volumes:
28      - data:/data
29    # Small: this site serves forms and reads a database that holds tens of
30    # rows. Argon2id at 64MB is the one thing here that wants memory.
31    deploy:
32      resources:
33        limits:
34          cpus: "0.50"
35          memory: 256M
36    healthcheck:
37      test: ["CMD", "/app", "-healthcheck"]
38      interval: 30s
39      timeout: 5s
40      retries: 3
41      start_period: 10s
42    security_opt:
43      - no-new-privileges:true
44    logging:
45      driver: json-file
46      options:
47        max-size: "10m"
48        max-file: "3"
49    networks: [edge]
50
51volumes:
52  data:
53    name: orchard-auth-data
54
55networks:
56  edge:
57    name: orchard-edge
58    external: true