docker-stack.yml - master - DnTyr/Password-Production

docker-stack.yml
179 строк4 KB
first_commit
03 июн 2026, 10:24
03 июн 2026, 10:245fb9f30
version: '3.8'

secrets:
  redis_password:
    external: true
  salt:
    external: true

services:
  backend:
    image: password-backend:23052026
    read_only: true
    volumes:
      - ./gunicorn_tmp:/gunicorn_tmp:rw
      - ./certs:/certs:ro
      - ./backend/app/static/words.txt:/app/app/static/words.txt:ro
    secrets:
      - source: redis_password
        target: redis_pw
      - source: salt
        target: salt
    env_file:
      - ./backend/.env
    environment:
      REDIS_HOST: "password-redis"
      REDIS_PORT: "6380"
      REDIS_PASSWORD_FILE: "/run/secrets/redis_pw"
      SALT_FILE: "/run/secrets/salt"
      TZ: UTC
    networks:
      backend-net:
        aliases:
          - backend
    healthcheck:
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      restart_policy:
        condition: any
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      resources:
        limits:
          memory: 2000M
          cpus: '2'

  redis:
    image: password-redis:23052026
    networks:
      backend-net:
        aliases:
          - password-redis
          - redis
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -p 6380 --tls --cacert /certs/ca.crt --cert /certs/redis.crt --key /certs/redis.key -a \"$$(cat /run/secrets/redis_pw)\" --no-auth-warning ping | grep PONG || exit 1"]
      interval: 10s
      timeout: 5s
      start_period: 60s
      retries: 10
    command:
      - sh
      - -c
      - |
        redis-server /usr/local/etc/redis/redis-tls.conf --requirepass "$$(cat /run/secrets/redis_pw)" --save "" --appendonly no
    secrets:
      - source: redis_password
        target: redis_pw
    volumes:
      - ./redis_data:/data
      - ./certs:/certs:ro
      - ./redis/redis-tls.conf:/usr/local/etc/redis/redis-tls.conf:ro
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      restart_policy:
        condition: any
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      resources:
        limits:
          memory: 2000M
          cpus: '1'

  honeypot:
    image: nginx:alpine
    networks:
      - honeypot-net
    command: /bin/sh -c "nginx -g 'daemon off;'"
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /usr/share/nginx/html
      - /etc/nginx/conf.d
    entrypoint: >
      /bin/sh -c "echo '<h1>Admin Access Denied</h1>' > /usr/share/nginx/html/index.html && 
      echo 'server { listen 8080; server_tokens off; location / { root /usr/share/nginx/html; try_files /index.html =404; } }' > /etc/nginx/conf.d/default.conf && 
      exec nginx -g 'daemon off;'"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      restart_policy:
        condition: any
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      resources:
        limits:
          memory: 32M
          cpus: '0.1'

  nginx:
    image: password-nginx:23052026
    networks:
      - frontend-net
      - backend-net
      - honeypot-net
    ports:
      - target: 8080
        published: 80
        protocol: tcp
        mode: host
      - target: 8443
        published: 443
        protocol: tcp
        mode: host
    volumes:
      - ./frontend/build:/usr/share/nginx/html:ro
      - ./nginx/security_headers.conf:/etc/nginx/security_headers.conf:ro
      - ./logs/nginx:/var/log/nginx:rw
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - ./nginx/ssl/server.crt:/etc/nginx/ssl/server.crt:ro
      - ./nginx/ssl/server.key:/etc/nginx/ssl/server.key:ro
      - ./certs:/etc/nginx/certs:ro
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      restart_policy:
        condition: any
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      resources:
        limits:
          memory: 512M
          cpus: '0.5'

networks:
  frontend-net:
    driver: overlay
    attachable: true
  backend-net:
    driver: overlay
    attachable: true
  honeypot-net:
    driver: overlay
    internal: true