7950430aa0
The VPS runs Caddy inside Docker as part of the Hephaestus stack (not system-wide angie as the earlier deploy/README assumed), so the shape of the deploy is: Prometheus runs as its own small docker-compose that attaches to Hephaestus's existing network, and Hephaestus's Caddy reverse-proxies prometheus.x → prometheus:3700. Dockerfile: node:22-alpine base (keeps the image ~55 MB and gives us node:sqlite stable), tini for signal handling, non-root `node` user, one /data volume holding the DB + ed25519 service key + uploads + snapshot build output. docker-compose: one service, attaches hephaestus_default as external network, env sourced from an .env file alongside the compose. The .env is NOT committed (contains ADMIN_PUBLISHER, optional VirusTotal key, optional payment config). Healthcheck polls /healthz. The deploy/prometheus-service.service systemd unit from the earlier commit is now unused on this host (kept for anyone deploying natively on a non-dockered box).
38 lines
1.2 KiB
Docker
38 lines
1.2 KiB
Docker
# Prometheus service image.
|
|
#
|
|
# Built for the standalone docker-compose at deploy/docker-compose.yml, which
|
|
# attaches to the hephaestus_default network so Hephaestus's Caddy can route
|
|
# prometheus.x → prometheus:3700 without either side knowing about the other.
|
|
#
|
|
# node:22-alpine keeps the image small (~55 MB with deps) and gives us
|
|
# node:sqlite (stable in 22+). We copy package files first so a code change
|
|
# that leaves deps alone reuses the npm layer.
|
|
|
|
FROM node:22-alpine
|
|
|
|
RUN apk add --no-cache tini
|
|
|
|
WORKDIR /opt/prometheus
|
|
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --omit=dev
|
|
|
|
COPY service/ ./service/
|
|
COPY public/ ./public/
|
|
COPY scripts/ ./scripts/
|
|
|
|
# /data holds everything that must survive a container rebuild: the SQLite
|
|
# DB, the service's own ed25519 key, uploaded binaries and (for the snapshot
|
|
# timer) the rendered static mirror.
|
|
ENV PROMETHEUS_DB=/data/db.sqlite \
|
|
PROMETHEUS_KEY_DIR=/data/keys \
|
|
PROMETHEUS_UPLOAD_DIR=/data/uploads \
|
|
BIND=0.0.0.0 \
|
|
PORT=3700
|
|
RUN mkdir -p /data/keys /data/uploads && chown -R node:node /data /opt/prometheus
|
|
USER node
|
|
|
|
EXPOSE 3700
|
|
|
|
ENTRYPOINT ["/sbin/tini", "--"]
|
|
CMD ["node", "service/server.js"]
|