55b2fe7646
updates/health.sh: 43 checks across all services (API answers, git refs, a push message round trip, SSO redirects and token endpoint, mesh state, backup age). updates/update.sh: per service pull or build, snapshot, recreate, wait for the health check, put image and data back on red and stop the run. backup/backup.sh: online dumps for n8n, Pocket ID and tinyauth; BACKUP_TAG so pre-update snapshots are not removed by the nightly keep-daily rule. compose.yml and caddy/Dockerfile: exact versions instead of latest, 16, 7-alpine and caddy:2-alpine.
17 lines
988 B
Docker
17 lines
988 B
Docker
# episode 10: the stock caddy:2-alpine image cannot rate limit. The directive
|
|
# lives in a plugin (github.com/mholt/caddy-ratelimit) that has to be compiled
|
|
# in with xcaddy - there is no runtime "enable" for it.
|
|
# episode 12: same trick for CrowdSec. The bouncer (http) and the AppSec
|
|
# handler (appsec) are plugins too, pinned to a release tag instead of @main.
|
|
# episode 17: every version is written down. "caddy:2-alpine" plus an unpinned
|
|
# plugin means the next rebuild is an update nobody decided on. docker compose
|
|
# pull never touches this image, it only changes when you run a build, so the
|
|
# compose file carries the same version in the image tag.
|
|
FROM caddy:2.11.7-builder-alpine AS builder
|
|
RUN xcaddy build \
|
|
--with github.com/mholt/caddy-ratelimit@v0.1.0 \
|
|
--with github.com/hslatman/caddy-crowdsec-bouncer/http@v0.14.1 \
|
|
--with github.com/hslatman/caddy-crowdsec-bouncer/appsec@v0.14.1
|
|
|
|
FROM caddy:2.11.7-alpine
|
|
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
|