orchard

 1name: orchard-status
 2
 3# No published ports. Traffic arrives through cloudflared to Caddy on the shared
 4# network.
 5
 6services:
 7  app:
 8    build:
 9      context: .
10      dockerfile: Dockerfile
11    container_name: orchard-status
12    restart: unless-stopped
13    # Longer than Docker's 10s default, because shutdown drains the log shipper
14    # queue and commits what the writer holds. Without it a slow drain means
15    # SIGKILL and a skipped db.Close().
16    stop_grace_period: 30s
17    # Chromium spawns a tree of processes per audit, and without an init as PID 1
18    # they become zombies that nothing reaps until the container hits its process
19    # limit. lighthouse.go's process-group kill covers the timeout case only.
20    init: true
21    environment:
22      # Read from .env in this directory, which compose picks up as the project
23      # directory. Write-only ntfy token, and an empty one is tolerated: refusing to start
24      # over a missing alert credential would turn a quiet notification into an
25      # outage.
26      NTFY_TOKEN: ${NTFY_TOKEN:-}
27    volumes:
28      - data:/data
29    # A ceiling to fail against rather than a target, since this machine is also
30    # a workstation. The high one here is Chromium: an OOM kill mid-audit would
31    # leave a property looking down when it is not.
32    deploy:
33      resources:
34        limits:
35          cpus: "2.00"
36          memory: 1536M
37    # The binary probes itself, since the scratch images here have no shell for a
38    # check to call, and `restart` only catches a process that has exited.
39    healthcheck:
40      test: ["CMD", "/app", "-healthcheck"]
41      interval: 30s
42      timeout: 5s
43      retries: 3
44      start_period: 10s
45    security_opt:
46      - no-new-privileges:true
47    # Otherwise container logs grow unbounded on a workstation.
48    logging:
49      driver: json-file
50      options:
51        max-size: "10m"
52        max-file: "3"
53    networks: [edge]
54
55volumes:
56  data:
57    name: orchard-status-data
58
59networks:
60  edge:
61    name: orchard-edge
62    external: true