122 lines
3.3 KiB
YAML
122 lines
3.3 KiB
YAML
services:
|
|
reverse-proxy:
|
|
image: "jwilder/nginx-proxy:latest"
|
|
container_name: "reverse-proxy"
|
|
volumes:
|
|
- app:/app
|
|
- html:/usr/share/nginx/html
|
|
- dhparam:/etc/nginx/dhparam
|
|
- vhost:/etc/nginx/vhost.d
|
|
- certs:/etc/nginx/certs
|
|
- confd:/etc/nginx/conf.d
|
|
- /run/docker.sock:/tmp/docker.sock:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
# Логи в bind-mount для удобства
|
|
- /mnt/nginx-proxy/logs:/var/log/nginx
|
|
restart: "always"
|
|
networks:
|
|
- net # Существующая сеть!
|
|
# КРИТИЧЕСКИ: Ограничиваем порты только на нужные IP
|
|
ports:
|
|
- "80:80" # Основной IP для других сервисов
|
|
- "443:443" # Основной IP для других сервисов
|
|
labels:
|
|
- "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy=true"
|
|
healthcheck:
|
|
test: ["CMD", "nginx", "-t"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.5' # Максимум 0.5 ядра
|
|
memory: 256M # Макс 256MB RAM
|
|
reservations:
|
|
cpus: '0.1' # Гарантированные 0.1 ядра
|
|
memory: 128M # Гарантированные 128MB
|
|
|
|
letsencrypt:
|
|
image: "jrcs/letsencrypt-nginx-proxy-companion:latest"
|
|
container_name: "letsencrypt-helper"
|
|
volumes:
|
|
- apple:/app
|
|
- html:/usr/share/nginx/html
|
|
- dhparam:/etc/nginx/dhparam
|
|
- vhost:/etc/nginx/vhost.d
|
|
- certs:/etc/nginx/certs
|
|
- /run/docker.sock:/var/run/docker.sock:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
environment:
|
|
NGINX_PROXY_CONTAINER: "reverse-proxy"
|
|
DEFAULT_EMAIL: "<адрес электронной почты на которую зарегистрирован letsencrypt>"
|
|
# Для тестирования (потом убрать):
|
|
# - "ACME_CA_URI=https://acme-staging-v02.api.letsencrypt.org/directory"
|
|
restart: "always"
|
|
depends_on:
|
|
- reverse-proxy
|
|
networks:
|
|
- net
|
|
healthcheck:
|
|
test: ["CMD", "pgrep", "letsencrypt_ser"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.2'
|
|
memory: 128M
|
|
reservations:
|
|
cpus: '0.05'
|
|
memory: 64M
|
|
|
|
volumes:
|
|
app:
|
|
driver: local
|
|
driver_opts:
|
|
type: none
|
|
device: /mnt/nginx-proxy/app
|
|
o: bind
|
|
apple:
|
|
driver: local
|
|
driver_opts:
|
|
type: none
|
|
device: /mnt/nginx-proxy/apple
|
|
o: bind
|
|
certs:
|
|
driver: local
|
|
driver_opts:
|
|
type: none
|
|
device: /mnt/nginx-proxy/certs
|
|
o: bind
|
|
html:
|
|
driver: local
|
|
driver_opts:
|
|
type: none
|
|
device: /mnt/nginx-proxy/html
|
|
o: bind
|
|
vhost:
|
|
driver: local
|
|
driver_opts:
|
|
type: none
|
|
device: /mnt/nginx-proxy/vhost
|
|
o: bind
|
|
dhparam:
|
|
driver: local
|
|
driver_opts:
|
|
type: none
|
|
device: /mnt/nginx-proxy/dhparam
|
|
o: bind
|
|
confd:
|
|
driver: local
|
|
driver_opts:
|
|
type: none
|
|
device: /mnt/nginx-proxy/conf.d
|
|
o: bind
|
|
|
|
networks:
|
|
net:
|
|
external: true
|
|
name: net # Явно указываем существующую сеть
|