docker-compose.yml - master - DnTyr/Password-Development

docker-compose.yml
158 строк3 KB
first_commit
03 июн 2026, 10:22
03 июн 2026, 10:22357cb35
secrets:
  redis_password:
    file: ./secrets/redis_password.txt    

services:

  backend:
    build: ./backend
    image: password-backend:latest 
    read_only: true
    tmpfs:
      - /tmp
      - /home/appuser/.gunicorn 
    secrets:
      - source: redis_password
        target: redis_pw
    env_file:
      - ./backend/.env
    environment:
      REDIS_HOST: "password-redis" 
      REDIS_PORT: "6379"
      REDIS_PASSWORD_FILE: "/run/secrets/redis_pw"
      TZ: UTC
    container_name: password-backend
    networks:
      - backend-net
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    mem_limit: 2000m
    cpus: 2
    expose:
      - "5000"
    depends_on:
      redis:
        condition: service_healthy
    volumes:
      - ./backend/app/static/words.txt:/app/app/static/words.txt:ro
    stop_signal: SIGINT 
    stop_grace_period: 30s
    pids_limit: 200
    ulimits:
      nofile:
        soft: 65535
        hard: 65535

  redis:
    build: ./redis
    container_name: password-redis
    init: true 
    networks:
      - backend-net
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    command:
      - sh
      - -c
      - |
        redis-server --requirepass "$$(cat /run/secrets/redis_pw)" --save "" --appendonly no
    secrets:
      - source: redis_password
        target: redis_pw
    mem_limit: 2000m
    cpus: 1
    volumes:
      - ./redis_data:/data
    stop_grace_period: 60s
    environment:
      TZ: UTC
    pids_limit: 512
    ulimits:
      nofile:
        soft: 65535
        hard: 65535

  honeypot:
    image: nginx:alpine
    container_name: password-honeypot
    networks:
      - honeypot-net
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    command: /bin/sh -c "nginx -g 'daemon off;'"
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /usr/share/nginx/html
      - /etc/nginx/conf.d
    entrypoint: >
      /bin/sh -c "echo '<h1>Admin Access Denied</h1>' > /usr/share/nginx/html/index.html && 
      echo 'server { listen 8080; server_tokens off; location / { root /usr/share/nginx/html; try_files /index.html =404; } }' > /etc/nginx/conf.d/default.conf && 
      exec nginx -g 'daemon off;'"
    mem_limit: 32m
    cpus: 0.1
    environment:
      TZ: UTC
    pids_limit: 32
    ulimits:
      nofile:
        soft: 1024
        hard: 2048
    

  nginx:
    build: ./nginx
    container_name: password-nginx
    networks:
      - frontend-net
      - backend-net
      - honeypot-net
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    mem_limit: 512m
    cpus: 0.5
    ports:
      - "127.0.0.1:80:8080"
      - "127.0.0.1:443:8443"
    volumes:
      - ./frontend/build:/usr/share/nginx/html:ro
      - ./nginx/security_headers.conf:/etc/nginx/security_headers.conf:ro
      - ./logs/nginx:/var/log/nginx:rw
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      - backend
    environment:
      TZ: UTC
    pids_limit: 100
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    security_opt:
    - no-new-privileges:true

networks:
    frontend-net:
      driver: bridge
    backend-net:
      driver: bridge
    honeypot-net:
      internal: true