logan
9f7c522157
- kubernetes/: 30Gi PVC、单副本 Recreate、Secret/Service/NodePort/Ingress 清单与部署文档 - 数据安全: kubeconfig/token 统一加密存储，启动迁移历史明文，DB 0600 - Token 接入: 命名空间级最小权限提示、长期 Token、自签证书 TLS 兼容 - 部署: 命名空间级 Token 下跳过 Namespace patch/枚举，节点信息容错 - 日志页: namespace → app → pod 选择顺序与作用域收窄 - 设置页: 拆分为通用/告警/LDAP/镜像源四个 tab - 弹框: 统一 max-h 滚动与长命令换行，修复内容溢出
116 lines
3.4 KiB
YAML
116 lines
3.4 KiB
YAML
# ============================================================
|
|
# opsx-loki - Development Docker Compose Configuration
|
|
# ============================================================
|
|
# P0 Fixes:
|
|
# - Non-root kubeconfig mount (/home/opsxloki/.kube)
|
|
# - Healthcheck for orchestration visibility
|
|
# - Resource limits to prevent noisy-neighbor
|
|
# - security_opt: no-new-privileges
|
|
# - Log rotation (json-file driver)
|
|
# - Named volumes instead of bind mounts
|
|
# P1 Fixes:
|
|
# - Restart policy optimization
|
|
# - Network isolation
|
|
# ============================================================
|
|
|
|
services:
|
|
opsxloki:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
TARGETARCH: ${TARGETARCH:-amd64}
|
|
image: lghost/opsxloki:latest
|
|
container_name: opsxloki
|
|
hostname: opsxloki
|
|
|
|
# ---- P0: Security options ----
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
# Required for healthcheck (wget) and runtime operations
|
|
- NET_BIND_SERVICE
|
|
# Required for file operations in /app/data
|
|
- CHOWN
|
|
- SETGID
|
|
- SETUID
|
|
read_only: false # Dev mode needs writable /app/data
|
|
|
|
ports:
|
|
- "${SERVER_PORT:-8080}:8080"
|
|
|
|
# ---- P0: Named volumes for data persistence ----
|
|
volumes:
|
|
- opsxloki-data:/app/data
|
|
# P0: Mount kubeconfig to non-root user directory
|
|
- ${KUBECONFIG_PATH:-${HOME}/.kube}:/home/opsxloki/.kube:ro
|
|
# SSH keys for host-based deployments
|
|
- ${SSH_KEY_PATH:-${HOME}/.ssh}:/home/opsxloki/.ssh:ro
|
|
|
|
# ---- P0: Environment variables (no default secrets) ----
|
|
environment:
|
|
- SERVER_PORT=8080
|
|
- DATA_DIR=/app/data
|
|
# P0: JWT_SECRET must be provided externally
|
|
# Set via .env file or shell export before running docker compose up.
|
|
# 注意：错误提示里不要内嵌 $(openssl ...)，否则会在 compose 解析时被执行。
|
|
- "JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required. Generate: openssl rand -hex 32, then: export JWT_SECRET=<value>}"
|
|
# P0: ENCRYPTION_KEY must be provided externally (AES-256, >=32 字符)
|
|
- "ENCRYPTION_KEY=${ENCRYPTION_KEY:?ENCRYPTION_KEY is required. Generate: openssl rand -hex 32, then: export ENCRYPTION_KEY=<value>}"
|
|
# KUBECONFIG points to non-root user's .kube directory
|
|
- KUBECONFIG=/home/opsxloki/.kube/config
|
|
|
|
# ---- P0: Healthcheck ----
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/index.html"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
|
|
# ---- P0: Resource limits ----
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2.0'
|
|
memory: 512M
|
|
pids: 100
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 64M
|
|
|
|
# ---- P0: Log rotation ----
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
labels: "service,image"
|
|
env: "SERVER_PORT,DATA_DIR"
|
|
|
|
# ---- P1: Restart policy ----
|
|
restart: unless-stopped
|
|
stop_grace_period: 15s
|
|
|
|
networks:
|
|
- opsxloki-net
|
|
|
|
# ---- Named volumes ----
|
|
volumes:
|
|
opsxloki-data:
|
|
driver: local
|
|
labels:
|
|
- "com.opsxloki.description=opsx-loki data directory"
|
|
|
|
# ---- Network isolation ----
|
|
networks:
|
|
opsxloki-net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.28.0.0/16
|
|
labels:
|
|
- "com.opsxloki.description=opsx-loki internal network"
|