998d0b0fca
Before this: service's /healthz always 503'd and the upload endpoint
rejected every submission with scan verdict=error, because clamd was not
installed anywhere reachable. Service worked for the seeded browse view
but no publisher could POST a listing.
Now: a `clamav` sibling container runs the official clamav/clamav:stable
image on an internal docker network only Prometheus can reach. The
Prometheus service connects via CLAMD_HOST=clamav. Signatures live in a
dedicated volume so restarts reuse the ~250 MB freshclam downloaded on
first start.
Two networks on the Prometheus container now:
prometheus-internal bridge, service + clamav only; clamd never exposed
hephaestus external hephaestus_default, so Hephaestus's Caddy
continues to route prometheus.x → prometheus:3700
depends_on with condition=service_healthy means Prometheus waits for
clamd's healthcheck to pass before starting. clamav's start_period is
5 min to accommodate the signature download; the healthcheck itself
is clamdcheck.sh / clamdscan --ping with a 10s timeout per probe.
Deploy on the VPS:
cd ~/prometheus && git pull && cd deploy
docker compose pull clamav # first time, 500+ MB
docker compose up -d # Prometheus will wait for clamav healthy
82 lines
2.4 KiB
YAML
82 lines
2.4 KiB
YAML
# Standalone compose for prometheus.x on the Hephaestus VPS.
|
|
#
|
|
# The service attaches to Hephaestus's existing docker network
|
|
# (hephaestus_default), so Hephaestus's Caddy can route prometheus.x to
|
|
# `prometheus:3700` with no changes to Hephaestus itself other than one new
|
|
# block in its Caddyfile.
|
|
#
|
|
# One volume (`data`) holds the SQLite DB, the service's ed25519 signing
|
|
# key, uploads that passed scan, and the snapshot build output. Env lives
|
|
# in an .env file alongside this one; the ones below are the defaults and
|
|
# can be overridden.
|
|
|
|
name: prometheus
|
|
|
|
services:
|
|
prometheus:
|
|
build:
|
|
context: ..
|
|
dockerfile: deploy/Dockerfile
|
|
image: prometheus:latest
|
|
restart: unless-stopped
|
|
depends_on:
|
|
clamav:
|
|
condition: service_healthy
|
|
environment:
|
|
BNS_NETWORK: chipnet
|
|
CLAMD_HOST: clamav
|
|
CLAMD_PORT: "3310"
|
|
ADMIN_PUBLISHER: ${ADMIN_PUBLISHER:-}
|
|
VIRUSTOTAL_API_KEY: ${VIRUSTOTAL_API_KEY:-}
|
|
PAYMENT_REQUIRED: ${PAYMENT_REQUIRED:-}
|
|
PROMETHEUS_PAYMENT_ADDRESS: ${PROMETHEUS_PAYMENT_ADDRESS:-}
|
|
PROMETHEUS_LISTING_FEE_USD: ${PROMETHEUS_LISTING_FEE_USD:-1}
|
|
BNS_GATEWAY: ${BNS_GATEWAY:-}
|
|
volumes:
|
|
- data:/data
|
|
networks:
|
|
- prometheus-internal
|
|
- hephaestus
|
|
expose:
|
|
- "3700"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--spider", "http://127.0.0.1:3700/healthz"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 60s
|
|
|
|
# ClamAV runs as a sibling container on an internal network — only
|
|
# Prometheus can reach it. First start downloads ~250 MB of signatures via
|
|
# freshclam into a volume; subsequent starts reuse it.
|
|
clamav:
|
|
image: clamav/clamav:stable
|
|
restart: unless-stopped
|
|
environment:
|
|
CLAMAV_NO_MILTERD: "true"
|
|
volumes:
|
|
- clamav-sigs:/var/lib/clamav
|
|
networks:
|
|
- prometheus-internal
|
|
expose:
|
|
- "3310"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "clamdcheck.sh || clamdscan --ping 2>/dev/null || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 10
|
|
# Signature download on first start can take a few minutes.
|
|
start_period: 5m
|
|
|
|
volumes:
|
|
data:
|
|
clamav-sigs:
|
|
|
|
networks:
|
|
# Internal: only Prometheus + clamav. Clamd never exposed off this network.
|
|
prometheus-internal:
|
|
driver: bridge
|
|
# External: shared with Hephaestus so its Caddy can route prometheus.x.
|
|
hephaestus:
|
|
external: true
|
|
name: hephaestus_default
|