Michael Czechowski
635a03098b
Dockerfile is multi-stage:
- build: golang:1.25-bookworm, CGO_ENABLED=0 (modernc.org/sqlite
is pure-Go) + -trimpath + -ldflags "-s -w" so the resulting
binary is small and reproducible-ish.
- runtime: gcr.io/distroless/static:nonroot, ~2 MB. Runs as uid
65532. /data and /var/lib/librenotes are declared volumes so
per-tenant notes and the SQLite database survive container
restarts.
healthcheck subcommand: distroless static has no shell or
wget/curl, so /healthz is reachable but no client to call it. A
new "librenotes healthcheck" subcommand uses net/http to GET
$LIBRENOTES_HEALTHCHECK_URL (default 127.0.0.1:8080/healthz) and
exits non-zero on failure. Both compose files invoke it from the
HEALTHCHECK directive.
httpapi adds a tiny GET /healthz that returns {"status":"ok"}
(no DB ping yet — added when readiness probes need it).
docker-compose.yml: dev stack on :8080 with named volumes and a
LogMailer; everything via env vars, JWT secret defaulted to a
dev value.
docker-compose.prod.yml: layered overrides — pulls a registry
image, expects LIBRENOTES_* env, sets memory limits and JSON-
file log rotation.
Closes #25.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
# docker-compose.prod.yml — production overrides.
|
|
#
|
|
# Use:
|
|
# docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
|
|
#
|
|
# Inputs (env or .env file):
|
|
# LIBRENOTES_IMAGE registry image, e.g. registry.librete.ch/librenotes:1.2.3
|
|
# LIBRENOTES_BASE_URL public origin, e.g. https://librenot.es
|
|
# LIBRENOTES_JWT_SECRET secrets manager value, NOT committed
|
|
# LIBRENOTES_SMTP_HOST real SMTP host
|
|
# LIBRENOTES_SMTP_PORT submission port (587 default)
|
|
# LIBRENOTES_SMTP_USER SMTP credential
|
|
# LIBRENOTES_SMTP_PASS SMTP credential
|
|
# LIBRENOTES_SMTP_FROM envelope sender (e.g. no-reply@librenot.es)
|
|
services:
|
|
librenotes:
|
|
image: ${LIBRENOTES_IMAGE}
|
|
build: !reset null
|
|
environment:
|
|
LIBRENOTES_BASE_URL: ${LIBRENOTES_BASE_URL}
|
|
LIBRENOTES_JWT_SECRET: ${LIBRENOTES_JWT_SECRET}
|
|
LIBRENOTES_SMTP_HOST: ${LIBRENOTES_SMTP_HOST}
|
|
LIBRENOTES_SMTP_PORT: ${LIBRENOTES_SMTP_PORT:-587}
|
|
LIBRENOTES_SMTP_USER: ${LIBRENOTES_SMTP_USER}
|
|
LIBRENOTES_SMTP_PASS: ${LIBRENOTES_SMTP_PASS}
|
|
LIBRENOTES_SMTP_FROM: ${LIBRENOTES_SMTP_FROM}
|
|
healthcheck:
|
|
test: ["CMD", "/librenotes", "healthcheck"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 256M
|
|
reservations:
|
|
memory: 64M
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|