52 lines
2.4 KiB
Plaintext
52 lines
2.4 KiB
Plaintext
# Opt-in server overlay for user-owned PostgreSQL sessions. Copy this file to a
|
|
# reviewed local override; it is intentionally not loaded by default Compose.
|
|
services:
|
|
core:
|
|
environment:
|
|
THOTH_PUBLIC_EXPOSURE: "true"
|
|
THT_SESSION_STORAGE: postgres
|
|
THT_CONFIG: /app/harness/workspaces/server-sessions.yaml
|
|
THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
|
|
THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
|
|
THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
|
|
THT_SESSION_RUNTIME_USER: ${THT_SESSION_RUNTIME_USER:?set THT_SESSION_RUNTIME_USER}
|
|
THT_SESSION_RUNTIME_PASSWORD_FILE: /run/secrets/session_runtime_password
|
|
THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
|
|
THT_SESSION_DB_SSLROOTCERT: /run/secrets/session_ca.pem
|
|
secrets:
|
|
- source: session_runtime_password
|
|
target: session_runtime_password
|
|
- source: session_ca
|
|
target: session_ca.pem
|
|
volumes:
|
|
- ${THT_SERVER_WORKSPACE_CONFIG:?set THT_SERVER_WORKSPACE_CONFIG}:/app/harness/workspaces/server-sessions.yaml:ro
|
|
|
|
# Run manually during the maintenance window. It is not a dependency of core,
|
|
# so the application never gains the schema-changing migrator credential.
|
|
session-migrate:
|
|
image: thothii-core:local
|
|
profiles: [session-migrate]
|
|
entrypoint: [/app/docker/session-migrate.sh]
|
|
environment:
|
|
THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
|
|
THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
|
|
THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
|
|
THT_SESSION_MIGRATOR_USER: ${THT_SESSION_MIGRATOR_USER:?set THT_SESSION_MIGRATOR_USER}
|
|
THT_SESSION_MIGRATOR_PASSWORD_FILE: /run/secrets/session_migrator_password
|
|
THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
|
|
THT_SESSION_DB_SSLROOTCERT: /run/secrets/session_ca.pem
|
|
secrets:
|
|
- source: session_migrator_password
|
|
target: session_migrator_password
|
|
- source: session_ca
|
|
target: session_ca.pem
|
|
restart: "no"
|
|
|
|
secrets:
|
|
session_runtime_password:
|
|
file: ${THT_SESSION_RUNTIME_PASSWORD_SOURCE:?set THT_SESSION_RUNTIME_PASSWORD_SOURCE}
|
|
session_migrator_password:
|
|
file: ${THT_SESSION_MIGRATOR_PASSWORD_SOURCE:?set THT_SESSION_MIGRATOR_PASSWORD_SOURCE}
|
|
session_ca:
|
|
file: ${THT_SESSION_CA_SOURCE:?set THT_SESSION_CA_SOURCE}
|