admin
1876fedfff
Docker secrets (postgresql_password, postgresql_pgadmin_password) already handled POSTGRES_PASSWORD_FILE/PGADMIN_DEFAULT_PASSWORD_FILE. This removes the two remaining `env_file: - postgresql.env` lines (postgresql + pgadmin services) which were redundant and left the stack in a half-migrated hybrid state. Non-secret vars (POSTGRES_USER, PGADMIN_DEFAULT_EMAIL, DATABASUS_HOST, PGADMIN_HOST) continue to be supplied via stack-deploy.sh's envsubst mechanism from postgresql.env at deploy time — no functional change to those values. Deployed and verified live on docker-2 prior to this commit: - postgresql_postgresql: pg_isready OK, all 21 databases intact, psql auth via Docker secret confirmed - postgresql_pgadmin: Host(`dba.bryanmail.net`) rule + PGADMIN_DEFAULT_EMAIL correct - postgresql_databasus: running - All dependent stacks (mealie, vaultwarden, auth, media, homeassistant, guacamole, security) remained healthy throughout, zero reconnect issues
119 lines
3.9 KiB
YAML
119 lines
3.9 KiB
YAML
version: "3.6"
|
|
services:
|
|
postgresql:
|
|
stop_grace_period: 60s
|
|
command:
|
|
- postgres
|
|
environment:
|
|
- POSTGRES_PASSWORD_FILE=/run/secrets/postgresql_password
|
|
- POSTGRES_USER=${POSTGRES_USER}
|
|
secrets:
|
|
- postgresql_password
|
|
hostname: db
|
|
image: public.ecr.aws/docker/library/postgres:17
|
|
networks:
|
|
- postgresql_db-backend
|
|
# - traefik_backend
|
|
- authentik_backend
|
|
ports:
|
|
- 5430:5432/tcp
|
|
volumes:
|
|
- /volume1/docker/PostgreSQL/data-17:/var/lib/postgresql/data
|
|
deploy:
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.tcp.routers.postgres.entrypoints=postgresql
|
|
- traefik.tcp.routers.postgres.rule=HostSNI(`*`)
|
|
- traefik.tcp.services.postgres.loadbalancer.server.port=5432
|
|
- traefik.tcp.routers.postgres.service=postgres
|
|
- traefik.swarm.network=traefik_backend
|
|
# resources:
|
|
# limits:
|
|
# cpus: '8' # Limit to 0.5 CPU core
|
|
# memory: 2G
|
|
placement:
|
|
constraints:
|
|
- node.labels.block != databases
|
|
- node.hostname == docker-2
|
|
|
|
databasus:
|
|
hostname: databasus
|
|
image: databasus/databasus:latest
|
|
# ports:
|
|
# - "4005:4005"
|
|
networks:
|
|
- traefik_backend
|
|
- postgresql_db-backend
|
|
volumes:
|
|
- /volume1/docker/databasus:/databasus-data
|
|
# - /volume1/SMB-docker/tmp:/tmp
|
|
deploy:
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.databasus.rule=Host(`${DATABASUS_HOST}`)
|
|
- traefik.http.routers.databasus.tls=true
|
|
- traefik.http.routers.databasus.tls.certresolver=letsencrypt
|
|
- traefik.http.routers.databasus.entrypoints=websecure
|
|
- traefik.http.services.databasus.loadbalancer.server.port=4005
|
|
- traefik.swarm.network=traefik_backend
|
|
# - traefik.http.routers.databasus.middlewares=forwardAuth-authentik@file, crowdsec@file
|
|
# - traefik.http.routers.databasus.middlewares=auth
|
|
# - traefik.http.middlewares.auth.basicauth.users=test:$$2a$$12$$1sIFlNKcNrEApe2IScpFwukd7l1j/uvfxk0GeuqIk0BBcO9Mk2F2u
|
|
# resources:
|
|
# limits:
|
|
# cpus: '4' # Limit to 0.5 CPU core
|
|
# memory: 2G
|
|
|
|
|
|
pgadmin:
|
|
image: dpage/pgadmin4:latest
|
|
environment:
|
|
PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
|
|
PGADMIN_DEFAULT_PASSWORD_FILE: /run/secrets/postgresql_pgadmin_password
|
|
PGADMIN_LISTEN_PORT: 80
|
|
secrets:
|
|
- postgresql_pgadmin_password
|
|
volumes:
|
|
- "/volume1/docker/PostgreSQL Admin:/var/lib/pgadmin"
|
|
# - "/volume1/docker/PostgreSQL Backups:/var/lib/pgadmin/storage/avb_bryanmail.net"
|
|
ports:
|
|
- 3030:80
|
|
networks:
|
|
- postgresql_db-backend
|
|
- traefik_backend
|
|
deploy:
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.pgadmin.rule=Host(`${PGADMIN_HOST}`)
|
|
- traefik.http.routers.pgadmin.tls=true
|
|
- traefik.http.routers.pgadmin.tls.certresolver=letsencrypt
|
|
- traefik.http.routers.pgadmin.entrypoints=websecure
|
|
- traefik.http.services.pgadmin.loadbalancer.server.port=80
|
|
- traefik.swarm.network=traefik_backend
|
|
# - traefik.http.routers.pgadmin.middlewares=forwardAuth-authentik@file, crowdsec@file
|
|
# - traefik.http.routers.pgadmin.middlewares=auth
|
|
# - traefik.http.middlewares.auth.basicauth.users=test:$$2a$$12$$1sIFlNKcNrEApe2IScpFwukd7l1j/uvfxk0GeuqIk0BBcO9Mk2F2u
|
|
resources:
|
|
limits:
|
|
cpus: '1' # Limit to 0.5 CPU core
|
|
memory: 512M
|
|
|
|
networks:
|
|
postgresql_db-backend:
|
|
name: postgresql_db-backend
|
|
# external: true
|
|
attachable: true
|
|
driver: overlay
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: "8950" #broke database connections for things like vaultwarden and Immich
|
|
traefik_backend:
|
|
external: true
|
|
authentik_backend:
|
|
external: true
|
|
|
|
secrets:
|
|
postgresql_password:
|
|
external: true
|
|
postgresql_pgadmin_password:
|
|
external: true
|