mirror of
https://github.com/Corfirean/coa-server-manager.git
synced 2026-11-11 11:51:03 +00:00
ДмитрийandClaude Sonnet 5.5
1267bcc41e
crates/coa-registry-proto (protocol 1: types, limits, signed-request canonicalisation, test vectors), services/coa-registry (axum + PostgreSQL, migrations, rate limits, Dockerfile, deploy files), services/coa-registry-e2e (Host lifecycle against the real service, live VPS gate), coa-core realm_registry (identity keys, client, publishing loop on its own thread), Settings -> Public listing card, docs REGISTRY_PROTOCOL.md and REGISTRY_DEPLOYMENT.md. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
# /opt/coa/postgres/compose.yaml (Phase 10). No `ports:`: PostgreSQL is reachable only on the internal coa-db network.
|
|
# The superuser password is read from /opt/coa/secrets (never in git); the Registry has its own least-privilege role and database.
|
|
name: coa-postgres
|
|
services:
|
|
postgres:
|
|
image: postgres:17
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: coa
|
|
POSTGRES_DB: coa
|
|
POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
|
|
POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256 --auth-local=scram-sha-256"
|
|
command: ["postgres", "-c", "max_connections=40", "-c", "shared_buffers=128MB", "-c", "password_encryption=scram-sha-256", "-c", "log_min_duration_statement=1000"]
|
|
secrets:
|
|
- postgres_password
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
networks:
|
|
coa-db:
|
|
aliases:
|
|
- coa-postgres
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U coa -d coa"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
mem_limit: 768m
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
secrets:
|
|
postgres_password:
|
|
file: /opt/coa/secrets/postgres_password
|
|
volumes:
|
|
pgdata:
|
|
networks:
|
|
coa-db:
|
|
external: true
|