56 lines
2.5 KiB
Plaintext
56 lines
2.5 KiB
Plaintext
# Opt-in server overlay for user-owned PostgreSQL sessions. Copy this file to a
|
|
# reviewed local override; it is intentionally not loaded by default Compose.
|
|
services:
|
|
core:
|
|
environment:
|
|
AUTH_MODE: upstream
|
|
THOTH_PUBLIC_EXPOSURE: "true"
|
|
THT_SESSION_STORAGE: postgres
|
|
THT_CONFIG: /app/harness/workspaces/server-sessions.yaml
|
|
THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
|
|
THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
|
|
THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
|
|
THT_SESSION_RUNTIME_USER: ${THT_SESSION_RUNTIME_USER:?set THT_SESSION_RUNTIME_USER}
|
|
THT_SESSION_RUNTIME_PASSWORD_FILE: /run/secrets/session_runtime_password
|
|
THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
|
|
THT_SESSION_DB_SSLROOTCERT: /run/secrets/session_ca.pem
|
|
secrets:
|
|
- source: session_runtime_password
|
|
target: session_runtime_password
|
|
- source: session_ca
|
|
target: session_ca.pem
|
|
volumes:
|
|
- ./deploy/workspaces:/app/harness/workspaces:ro
|
|
|
|
# Run manually during the maintenance window. It is not a dependency of core,
|
|
# so the application never gains the schema-changing migrator credential.
|
|
session-migrate:
|
|
image: thothii-core:local
|
|
profiles: [session-migrate]
|
|
entrypoint: [/bin/sh, -ec]
|
|
command: >-
|
|
export PGPASSWORD="$$(cat /run/secrets/session_migrator_password)";
|
|
exec /opt/venv/bin/tht session migrate --database-url
|
|
"postgresql+psycopg2://$${THT_SESSION_MIGRATOR_USER}@$${THT_SESSION_DB_HOST}:$${THT_SESSION_DB_PORT}/$${THT_SESSION_DB_NAME}?sslmode=$${THT_SESSION_DB_SSLMODE}&sslrootcert=/run/secrets/session_ca.pem"
|
|
--json
|
|
environment:
|
|
THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
|
|
THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
|
|
THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
|
|
THT_SESSION_MIGRATOR_USER: ${THT_SESSION_MIGRATOR_USER:?set THT_SESSION_MIGRATOR_USER}
|
|
THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
|
|
secrets:
|
|
- source: session_migrator_password
|
|
target: session_migrator_password
|
|
- source: session_ca
|
|
target: session_ca.pem
|
|
restart: "no"
|
|
|
|
secrets:
|
|
session_runtime_password:
|
|
file: ${THT_SESSION_RUNTIME_PASSWORD_SOURCE:?set THT_SESSION_RUNTIME_PASSWORD_SOURCE}
|
|
session_migrator_password:
|
|
file: ${THT_SESSION_MIGRATOR_PASSWORD_SOURCE:?set THT_SESSION_MIGRATOR_PASSWORD_SOURCE}
|
|
session_ca:
|
|
file: ${THT_SESSION_CA_SOURCE:?set THT_SESSION_CA_SOURCE}
|