| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071 |
- name: dataops-enterprise-edge
- services:
- edge-gateway:
- build:
- context: ../..
- dockerfile: deploy/edge/Dockerfile.edge
- image: "${EDGE_IMAGE:-dataops-edge:local}"
- pull_policy: "${EDGE_PULL_POLICY:-build}"
- command: ["python", "-m", "app.edge_gateway"]
- user: "${EDGE_RUNTIME_UID:?}:${EDGE_RUNTIME_GID:?}"
- read_only: true
- cap_drop:
- - ALL
- security_opt:
- - no-new-privileges:true
- pids_limit: 128
- mem_limit: 1g
- cpus: "1.0"
- restart: unless-stopped
- init: true
- stop_grace_period: 30s
- environment:
- EDGE_CONFIG_PATH: "${EDGE_CONFIG_PATH:-/run/edge/config/edge.json}"
- EDGE_CREDENTIAL_FILE: /run/edge/secrets/control-credential
- EDGE_CLIENT_CERTIFICATE_PATH: /run/edge/certificates/client.pem
- EDGE_CLIENT_PRIVATE_KEY_PATH: "${EDGE_CLIENT_PRIVATE_KEY_PATH:-/run/edge/secrets/client.key}"
- EDGE_CA_BUNDLE_PATH: /run/edge/certificates/ca.pem
- EDGE_SERVER_CRL_PATH: "${EDGE_SERVER_CRL_PATH:-/run/edge/certificates/control-plane-server.crl.pem}"
- EDGE_HEALTH_PATH: "${EDGE_HEALTH_PATH:-/run/edge/tmp/health.json}"
- EDGE_RELEASE_SIGNING_KEYS_PATH: /run/edge/signing/release-public-keys.json
- EDGE_TASK_SIGNING_KEYS_PATH: /run/edge/signing/task-public-keys.json
- EDGE_CONTROL_ORIGIN: "${EDGE_CONTROL_ORIGIN:?exact https control origin required}"
- EDGE_PROXY_ORIGIN: "${EDGE_PROXY_ORIGIN:-}"
- EDGE_ALLOWED_CONTROL_HOSTS: "${EDGE_ALLOWED_CONTROL_HOSTS:?exact control hosts required}"
- EDGE_ALLOWED_PROXY_HOSTS: "${EDGE_ALLOWED_PROXY_HOSTS:-}"
- EDGE_LOG_LEVEL: "${EDGE_LOG_LEVEL:-INFO}"
- EDGE_LOG_MAX_BYTES: "${EDGE_LOG_MAX_BYTES:-10485760}"
- EDGE_LOG_BACKUP_COUNT: "${EDGE_LOG_BACKUP_COUNT:-3}"
- EDGE_POLL_INTERVAL_SECONDS: "${EDGE_POLL_INTERVAL_SECONDS:-5}"
- volumes:
- - "${EDGE_CONFIG_DIR:?}:/run/edge/config:ro"
- - "${EDGE_QUEUE_DIR:?}:/var/lib/dataops-edge/queue:rw"
- - "${EDGE_ARTIFACT_DIR:?}:/var/lib/dataops-edge/artifacts:rw"
- - "${EDGE_RELEASE_DIR:?}:/var/lib/dataops-edge/releases:rw"
- - "${EDGE_SECRET_DIR:?}:/run/edge/secrets:ro"
- - "${EDGE_CERTIFICATE_DIR:?}:/run/edge/certificates:ro"
- - "${EDGE_SIGNING_KEY_DIR:?}:/run/edge/signing:ro"
- tmpfs:
- - /tmp:rw,noexec,nosuid,nodev,size=64m,mode=1777
- - /run/edge/tmp:rw,noexec,nosuid,nodev,size=16m,mode=0700,uid=${EDGE_RUNTIME_UID:?},gid=${EDGE_RUNTIME_GID:?}
- healthcheck:
- test: ["CMD", "python", "-m", "app.edge_gateway.healthcheck"]
- interval: 30s
- timeout: 5s
- retries: 3
- start_period: 20s
- logging:
- driver: json-file
- options:
- max-size: "10m"
- max-file: "3"
- networks:
- - edge-egress
- networks:
- edge-egress:
- driver: bridge
- internal: false
- labels:
- dataops.network-contract: "outbound-only; enforce exact egress destinations outside Compose"
|
