Docker bypasses ufw and exposes 0.0.0.0-bound ports directly via iptables DNAT rules, even when ufw default policy is deny. Bind every service port to 127.0.0.1 so only nginx (and SSH tunnels for wizard) can reach them from outside.
144 lines
3.5 KiB
YAML
144 lines
3.5 KiB
YAML
services:
|
|
backend:
|
|
image: git.hangman-lab.top/hzhang/hangmanlab-backend:latest
|
|
ports:
|
|
- "127.0.0.1:$BACKEND_PORT:$BACKEND_PORT"
|
|
env_file:
|
|
- .env
|
|
depends_on:
|
|
- mysql
|
|
networks:
|
|
- app-network
|
|
volumes:
|
|
- backend_dump:/app/dump
|
|
|
|
frontend:
|
|
image: git.hangman-lab.top/hzhang/hangmanlab-frontend:latest
|
|
ports:
|
|
- "127.0.0.1:$FRONTEND_PORT:80"
|
|
env_file:
|
|
- .env
|
|
depends_on:
|
|
- backend
|
|
networks:
|
|
- app-network
|
|
|
|
mysql:
|
|
image: mysql:8.0
|
|
container_name: mysql
|
|
ports:
|
|
- "127.0.0.1:$DB_PORT:$DB_PORT"
|
|
environment:
|
|
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
|
|
MYSQL_DATABASE: ${DB_NAME}
|
|
MYSQL_USER: ${DB_USER}
|
|
MYSQL_PASSWORD: ${DB_PASSWORD}
|
|
volumes:
|
|
- mysql_data:/var/lib/mysql
|
|
networks:
|
|
- app-network
|
|
healthcheck:
|
|
test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-p${MYSQL_ROOT_PASSWORD}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
hf_db_init:
|
|
image: mysql:8.0
|
|
restart: "no"
|
|
environment:
|
|
MYSQL_HOST: mysql
|
|
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
|
|
DB_USER: ${DB_USER}
|
|
HF_DB_NAME: ${HF_DB_NAME:-harborforge}
|
|
volumes:
|
|
- ./mysql-init/10-harborforge.sh:/init/10-harborforge.sh:ro
|
|
entrypoint: ["/bin/sh", "/init/10-harborforge.sh"]
|
|
depends_on:
|
|
mysql:
|
|
condition: service_healthy
|
|
networks:
|
|
- app-network
|
|
|
|
hf_backend:
|
|
image: git.hangman-lab.top/zhi/harborforge-backend:multi-stage
|
|
restart: "no"
|
|
ports:
|
|
- "127.0.0.1:$HF_BACKEND_PORT:8000"
|
|
volumes:
|
|
- wizard_config:/config:ro
|
|
environment:
|
|
CONFIG_DIR: /config
|
|
CONFIG_FILE: harborforge.json
|
|
SECRET_KEY: ${HF_SECRET_KEY:-change_me_in_production}
|
|
LOG_LEVEL: ${HF_LOG_LEVEL:-INFO}
|
|
DATABASE_URL: mysql+pymysql://${DB_USER}:${DB_PASSWORD}@mysql:3306/${HF_DB_NAME:-harborforge}
|
|
depends_on:
|
|
hf_db_init:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- app-network
|
|
|
|
wizard_init:
|
|
image: busybox:1.36
|
|
restart: "no"
|
|
user: "0:0"
|
|
volumes:
|
|
- wizard_config:/config
|
|
command: ["sh", "-c", "chown -R 65532:65532 /config"]
|
|
|
|
wizard:
|
|
image: git.hangman-lab.top/nav/abstract-wizard:latest
|
|
ports:
|
|
- "127.0.0.1:$WIZARD_PORT:8080"
|
|
volumes:
|
|
- wizard_config:/config
|
|
environment:
|
|
CONFIG_DIR: /config
|
|
LISTEN_ADDR: "0.0.0.0:8080"
|
|
MAX_BACKUPS: "5"
|
|
CORS_ORIGINS: ${HF_FRONTEND_HOST}
|
|
depends_on:
|
|
wizard_init:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- app-network
|
|
|
|
hf_frontend:
|
|
image: git.hangman-lab.top/zhi/harborforge-frontend:latest
|
|
ports:
|
|
- "127.0.0.1:$HF_FRONTEND_PORT:3000"
|
|
environment:
|
|
FRONTEND_DEV_MODE: ${HF_FRONTEND_DEV_MODE:-0}
|
|
NODE_ENV: production
|
|
depends_on:
|
|
- wizard
|
|
- hf_backend
|
|
networks:
|
|
- app-network
|
|
|
|
harborforge-monitor:
|
|
image: git.hangman-lab.top/zhi/harborforge-monitor:latest
|
|
container_name: harborforge-monitor
|
|
restart: unless-stopped
|
|
environment:
|
|
HF_MONITER_BACKEND_URL: ${HF_MONITOR_BACKEND_URL:-https://hf-api.hangman-lab.top}
|
|
HF_MONITER_IDENTIFIER: ${HF_MONITOR_IDENTIFIER}
|
|
HF_MONITER_API_KEY: ${HF_MONITOR_API_KEY}
|
|
HF_MONITER_REPORT_INTERVAL: "30"
|
|
HF_MONITER_LOG_LEVEL: info
|
|
HF_MONITER_ROOTFS: /host
|
|
volumes:
|
|
- /:/host:ro
|
|
network_mode: host
|
|
|
|
networks:
|
|
app-network:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
mysql_data:
|
|
backend_dump:
|
|
wizard_config:
|