54 lines
2.6 KiB
YAML
54 lines
2.6 KiB
YAML
---
|
|
version: "3.8"
|
|
# cc-ci ENVIRONMENTAL overlay for rustdesk-server — applies to ALL deploys (base + PR head).
|
|
#
|
|
# rustdesk-server has NO HTTP surface (hbbs/hbbr speak their own protobuf protocol on
|
|
# host-published 21115-21119; the stock traefik labels point at a dead :80). cc-ci's install
|
|
# tier gates on an HTTPS serving signal through Traefik, so this overlay adds a `status`
|
|
# sidecar serving exactly ONE real app artifact: hbbs's generated identity PUBLIC key at
|
|
# /id_ed25519.pub (mounted read-only from the shared rustdesk_data volume). The health gate
|
|
# then proves domain routing AND that hbbs booted far enough to mint its keypair. The private
|
|
# key and the sqlite peer DB in the same volume are never exposed: nginx serves only the
|
|
# exact .pub location, everything else 404s.
|
|
#
|
|
# Node-reality tweaks ONLY — no version-specific image pins, no changes to the app/signal
|
|
# services (the stock app's vestigial Host(`${DOMAIN}`) router on :80 is left untouched; the
|
|
# status router declares an explicit higher priority so it deterministically wins the tie).
|
|
services:
|
|
status:
|
|
image: nginx:1.31.8
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
printf '%s\n' \
|
|
'user root;' \
|
|
'worker_processes 1;' \
|
|
'error_log /dev/stderr warn;' \
|
|
'pid /tmp/nginx.pid;' \
|
|
'events { worker_connections 128; }' \
|
|
'http { default_type text/plain; access_log off;' \
|
|
' server { listen 80;' \
|
|
' location = /id_ed25519.pub { alias /pub/id_ed25519.pub; }' \
|
|
' location / { return 404; }' \
|
|
' }' \
|
|
'}' > /etc/nginx/nginx.conf
|
|
exec nginx -g 'daemon off;'
|
|
volumes:
|
|
# rustdesk_data is owned root:0700 (hbbs's /root), and id_ed25519.pub is 0644 — workers
|
|
# must run as root (user root; above) to traverse the volume dir. Read-only mount; the
|
|
# private key (id_ed25519) and db_v2.sqlite3 are unreachable through the config above.
|
|
- rustdesk_data:/pub:ro
|
|
networks:
|
|
- proxy
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.${STACK_NAME}-status.rule=Host(`${DOMAIN}`)"
|
|
- "traefik.http.routers.${STACK_NAME}-status.entrypoints=web-secure"
|
|
- "traefik.http.routers.${STACK_NAME}-status.tls.certresolver=${LETS_ENCRYPT_ENV}"
|
|
# Explicit priority: the stock app router claims the same Host rule against a dead
|
|
# :80 backend; without this the winner of the equal-default-priority tie is undefined.
|
|
- "traefik.http.routers.${STACK_NAME}-status.priority=100"
|
|
- "traefik.http.services.${STACK_NAME}-status.loadbalancer.server.port=80"
|