Iain Sproat
68fd86b754
* chore(frontend): use bitnami/openresty as base image for frontend Dockerfile
openresty/openresty was not being patched as frequently as we would like, resulting in numerous
vulnerabilities without resolution. bitnami/openresty is being patched more frequently.
Some additional changes were necessary when porting our frontend between these distributions:
- html files are in /app
- nginx.conf is in /opt/bitnami/openresty/nginx/conf/nginx.conf
- envsubst is not available by default in bitnami/openresty and needs to be copied in
- Nginx.conf - we wrap the server block in http block and overwrite root nginx.conf
- using the existing bitnami/openresty nginx.conf as a server block alone causes issues with bitnami/openresty, as bitnami/openresty provides a root nginx.conf which conflicts with directives in Speckle's server block
- we copy the directives from openresty/openresty (which are known to work with Speckle's server block), and apply them alongside Speckle's server block. This creates a new root nginx.conf which we can overwrite the default on the image.
- nginx should use a port available to non sudo/root user, we have selected 8080 instead of previous 80
- need to explicitly output nginx logs to stderr / stdout
Created a readonly root file system on Kubernetes. This requires the following changes:
- emptyDir volumes are mounted in kubernetes to allow bitnami/openresty to write to specific locations
- explicitly include and copy mime.types file to nginx configuration directory
Due to the change to non-privileged port number (8080), the following subsequent changes were required:
- Update 1-click deployment script to match frontend at port 8080
- Updates docker-compose-speckle.yaml file
Co-authored-by: Gergő Jedlicska <gergo@jedlicska.com>
116 lines
2.8 KiB
YAML
116 lines
2.8 KiB
YAML
version: '2'
|
|
services:
|
|
####
|
|
# Speckle Server dependencies
|
|
#######
|
|
postgres:
|
|
image: 'postgres:14.5-alpine'
|
|
restart: always
|
|
environment:
|
|
POSTGRES_DB: speckle
|
|
POSTGRES_USER: speckle
|
|
POSTGRES_PASSWORD: speckle
|
|
volumes:
|
|
- ./postgres-data:/var/lib/postgresql/data/
|
|
ports:
|
|
- '127.0.0.1:5432:5432'
|
|
|
|
redis:
|
|
image: 'redis:7.0-alpine'
|
|
restart: always
|
|
volumes:
|
|
- ./redis-data:/data
|
|
ports:
|
|
- '127.0.0.1:6379:6379'
|
|
|
|
minio:
|
|
image: 'minio/minio'
|
|
command: server /data --console-address ":9001"
|
|
restart: always
|
|
volumes:
|
|
- ./minio-data:/data
|
|
ports:
|
|
- '127.0.0.1:9000:9000'
|
|
- '127.0.0.1:9001:9001'
|
|
|
|
####
|
|
# Speckle Server
|
|
#######
|
|
speckle-frontend:
|
|
image: speckle/speckle-frontend:2
|
|
restart: always
|
|
ports:
|
|
- '127.0.0.1:8080:8080'
|
|
environment:
|
|
FILE_SIZE_LIMIT_MB: 100
|
|
|
|
speckle-server:
|
|
image: speckle/speckle-server:2
|
|
restart: always
|
|
ports:
|
|
- '127.0.0.1:3000:3000'
|
|
command: ['bash', '-c', '/wait && node bin/www']
|
|
environment:
|
|
CANONICAL_URL: 'TODO: change'
|
|
SESSION_SECRET: 'TODO: change'
|
|
|
|
STRATEGY_LOCAL: 'true'
|
|
LOG_LEVEL: 'info'
|
|
|
|
POSTGRES_URL: 'postgres'
|
|
POSTGRES_USER: 'speckle'
|
|
POSTGRES_PASSWORD: 'speckle'
|
|
POSTGRES_DB: 'speckle'
|
|
|
|
REDIS_URL: 'redis://redis'
|
|
WAIT_HOSTS: 'postgres:5432, redis:6379, minio:9000'
|
|
|
|
EMAIL: 'false'
|
|
EMAIL_HOST: 'TODO'
|
|
EMAIL_PORT: 'TODO'
|
|
EMAIL_USERNAME: 'TODO'
|
|
EMAIL_PASSWORD: 'TODO'
|
|
EMAIL_FROM: 'TODO'
|
|
|
|
EMAIL_SECURE: 'false'
|
|
|
|
S3_ENDPOINT: 'http://minio:9000'
|
|
S3_ACCESS_KEY: 'minioadmin'
|
|
S3_SECRET_KEY: 'minioadmin'
|
|
S3_BUCKET: 'speckle-server'
|
|
S3_CREATE_BUCKET: 'true'
|
|
S3_REGION: '' # optional, defaults to 'us-east-1'
|
|
|
|
FILE_SIZE_LIMIT_MB: 100
|
|
|
|
speckle-preview-service:
|
|
image: speckle/speckle-preview-service:2
|
|
restart: always
|
|
mem_limit: '1000m'
|
|
memswap_limit: '1000m'
|
|
command: ['bash', '-c', '/wait && node bin/www']
|
|
|
|
environment:
|
|
LOG_LEVEL: 'info'
|
|
PG_CONNECTION_STRING: 'postgres://speckle:speckle@postgres/speckle'
|
|
WAIT_HOSTS: 'postgres:5432'
|
|
|
|
speckle-webhook-service:
|
|
image: speckle/speckle-webhook-service:2
|
|
restart: always
|
|
command: ['bash', '-c', '/wait && node main.js']
|
|
environment:
|
|
LOG_LEVEL: 'info'
|
|
PG_CONNECTION_STRING: 'postgres://speckle:speckle@postgres/speckle'
|
|
WAIT_HOSTS: 'postgres:5432'
|
|
|
|
fileimport-service:
|
|
image: speckle/speckle-fileimport-service:2
|
|
restart: always
|
|
command: ['bash', '-c', '/wait && node src/daemon.js']
|
|
environment:
|
|
LOG_LEVEL: 'info'
|
|
PG_CONNECTION_STRING: 'postgres://speckle:speckle@postgres/speckle'
|
|
WAIT_HOSTS: 'postgres:5432'
|
|
SPECKLE_SERVER_URL: 'http://speckle-server:3000'
|