Melvin Strobl
72c1d73e96
C4: a device's `viewers` (superusers by default, or members) covers the image and video messages its ports publish. Anyone else gets none of their values on the socket, in the catalogue or a flow's state, 403 for their history, for the frames they hold (the last 8 included) and for TURN credentials, no bytes when asking for them, and `bye: forbidden` for a live view. A device credential stays bounded by its dashboards. The device page sets it in its Camera section, and a tile the viewer may not see says "No access to this camera" and asks the camera for nothing. C3: - A volatile upload is held to MAX_FRAME_BYTES (4 MiB, 413 above it, read without extra copies), and so is a frame on a device's socket. - A frame the engine holds in memory is written to the ring directory before a local worker is handed it, so load_artifact finds it. - A socket the bus dropped events for catches up with a snapshot, demand included, and a device's credential is checked again per frame, cached by the flow store revision and its nonce, so a lost event never keeps an unpaired device's frames coming. - A report is at most 64 KB once its named config_schemas are put in place. - A device away for 60 s has its true bool messages set to false. - Refused frames are logged by fixed keys, a frame is named after its message, `fluksio serve` waits 5 s for open connections, a tile with a stream URL creates no demand, the 8-name cap keeps the newest names. - Every container's log rotates (json-file, 3 x 10 MB).
92 lines
4.4 KiB
YAML
92 lines
4.4 KiB
YAML
# Every container's log rotates: json-file, at most 3 files of 10 MB each.
|
|
# Docker's default keeps one file that grows until the host's disk is full.
|
|
x-logging: &logging
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
services:
|
|
traefik:
|
|
logging: *logging
|
|
# A patch tag, so a host holding an older cached 3.6 pulls this one. 3.6.25
|
|
# knows --accesslog.fields.queryparameters, which older 3.6 refuses.
|
|
image: traefik:3.6.25
|
|
ports:
|
|
# Listen on port 80, default for HTTP, necessary to redirect to HTTPS
|
|
- 80:80
|
|
# Listen on port 443, default for HTTPS
|
|
- 443:443
|
|
restart: always
|
|
labels:
|
|
# Enable Traefik for this service, to make it available in the public network
|
|
- traefik.enable=true
|
|
# Use the proxy network (declared below)
|
|
- traefik.docker.network=proxy
|
|
# Define the port inside of the Docker service to use
|
|
- traefik.http.services.traefik-dashboard.loadbalancer.server.port=8080
|
|
# Make Traefik use this domain (from an environment variable) in HTTP
|
|
- traefik.http.routers.traefik-dashboard-http.entrypoints=http
|
|
- traefik.http.routers.traefik-dashboard-http.rule=Host(`traefik.${DOMAIN?Variable not set}`)
|
|
# traefik-https the actual router using HTTPS
|
|
- traefik.http.routers.traefik-dashboard-https.entrypoints=https
|
|
- traefik.http.routers.traefik-dashboard-https.rule=Host(`traefik.${DOMAIN?Variable not set}`)
|
|
- traefik.http.routers.traefik-dashboard-https.tls=true
|
|
# Use the "le" (Let's Encrypt) resolver created below
|
|
- traefik.http.routers.traefik-dashboard-https.tls.certresolver=le
|
|
# Use the special Traefik service api@internal with the web UI/Dashboard
|
|
- traefik.http.routers.traefik-dashboard-https.service=api@internal
|
|
# https-redirect middleware to redirect HTTP to HTTPS
|
|
- traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
|
|
- traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
|
|
# traefik-http set up only to use the middleware to redirect to https
|
|
- traefik.http.routers.traefik-dashboard-http.middlewares=https-redirect
|
|
# admin-auth middleware with HTTP Basic auth
|
|
# Using the environment variables USERNAME and HASHED_PASSWORD
|
|
- traefik.http.middlewares.admin-auth.basicauth.users=${USERNAME?Variable not set}:${HASHED_PASSWORD?Variable not set}
|
|
# Enable HTTP Basic auth, using the middleware created above
|
|
- traefik.http.routers.traefik-dashboard-https.middlewares=admin-auth
|
|
volumes:
|
|
# Add Docker as a mounted volume, so that Traefik can read the labels of other services
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
# Mount the volume to store the certificates
|
|
- traefik-certificates:/certificates
|
|
command:
|
|
# Enable Docker in Traefik, so that it reads labels from Docker services
|
|
- --providers.docker
|
|
# Do not expose all Docker services, only the ones explicitly exposed
|
|
- --providers.docker.exposedbydefault=false
|
|
# Create an entrypoint "http" listening on port 80
|
|
- --entrypoints.http.address=:80
|
|
# Create an entrypoint "https" listening on port 443
|
|
- --entrypoints.https.address=:443
|
|
# Create the certificate resolver "le" for Let's Encrypt, uses the environment variable EMAIL
|
|
- --certificatesresolvers.le.acme.email=${EMAIL?Variable not set}
|
|
# Store the Let's Encrypt certificates in the mounted volume
|
|
- --certificatesresolvers.le.acme.storage=/certificates/acme.json
|
|
# Use the TLS Challenge for Let's Encrypt
|
|
- --certificatesresolvers.le.acme.tlschallenge=true
|
|
# Enable the access log, with HTTP requests
|
|
- --accesslog
|
|
# Without query strings: the live socket and a worker's attach carry their
|
|
# token there, and Traefik can drop query values but not mask them
|
|
- --accesslog.fields.queryparameters.defaultmode=drop
|
|
# Enable the Traefik log, for configurations and errors
|
|
- --log
|
|
# Enable the Dashboard and API
|
|
- --api
|
|
networks:
|
|
# Use the public network created to be shared between Traefik and
|
|
# any other service that needs to be publicly available with HTTPS
|
|
- proxy
|
|
|
|
volumes:
|
|
# Create a volume to store the certificates, even if the container is recreated
|
|
traefik-certificates:
|
|
|
|
networks:
|
|
# Use the previously created public network "proxy", shared with other
|
|
# services that need to be publicly available via this Traefik
|
|
proxy:
|
|
external: true
|