|
1 | | -{# Stores storage items that contains info for volumes, vol mounts, perms dirs and perms mounts #} |
2 | | -{% set storage_items = namespace(items=[]) %} |
3 | | -{# Stores the top level volumes #} |
4 | | -{% set volumes = namespace(items={}) %} |
5 | | -{# Stores the container volume mounts #} |
6 | | -{% set volume_mounts = namespace(items=[]) %} |
7 | | -{# Stores the perms container volume mounts #} |
8 | | -{% set perms_mounts = namespace(items=[]) %} |
9 | | -{# Stores the perms container dirs #} |
10 | | -{% set perms_dirs = namespace(items=[]) %} |
11 | | - |
12 | | -{% do storage_items.items.append(ix_lib.base.storage.storage_item(data={"type": "anonymous", "mount_path": "/tmp"})) %} |
13 | | -{% do storage_items.items.append(ix_lib.base.storage.storage_item( |
14 | | - data={"type": "volume", "volume_name": "nginx-cache", "mount_path": "/var/cache/nginx", "auto_permissions": true}, |
15 | | - perm_opts={"mount_path": "/mnt/logseq/nginx-cache", "mode": "always", "uid": values.run_as.user, "gid": values.run_as.group, "chmod": "770"} |
16 | | -)) %} |
17 | | -{% do storage_items.items.append(ix_lib.base.storage.storage_item( |
18 | | - data={"type": "volume", "volume_name": "nginx-run", "mount_path": "/var/run", "auto_permissions": true}, |
19 | | - perm_opts={"mount_path": "/mnt/logseq/nginx-run", "mode": "always", "uid": values.run_as.user, "gid": values.run_as.group, "chmod": "770"} |
20 | | -)) %} |
21 | | - |
22 | | -{% for store in values.storage.additional_storage %} |
23 | | - {% do storage_items.items.append(ix_lib.base.storage.storage_item(data=store, values=values, |
24 | | - perm_opts={"mount_path": "/mnt/logseq/dir_%s"|format(loop.index0), "mode": "check", "uid": values.run_as.user, "gid": values.run_as.group} |
25 | | - )) %} |
26 | | -{% endfor %} |
27 | | - |
28 | | -{# Add each item to the above lists #} |
29 | | -{% for item in storage_items.items %} |
30 | | - {% if item.vol and volumes.items.update(item.vol) %}{% endif %} |
31 | | - {% if item.vol_mount and volume_mounts.items.append(item.vol_mount) %}{% endif %} |
32 | | - {% if item.perms_item and (perms_dirs.items.append(item.perms_item.perm_dir), perms_mounts.items.append(item.perms_item.vol_mount)) %}{% endif %} |
33 | | -{% endfor %} |
34 | | - |
35 | | -configs: |
| 1 | +{% from "macros/nginx.conf.jinja" import nginx_conf %} |
| 2 | +{% set tpl = ix_lib.base.render.Render(values) %} |
| 3 | + |
| 4 | +{% set proto = "https" if values.network.certificate_id else "http" %} |
| 5 | +{% set c1 = tpl.add_container(values.consts.logseq_container_name, "image") %} |
| 6 | +{% set perm_container = tpl.deps.perms(values.consts.perms_container_name) %} |
| 7 | +{% set perms_config = {"uid": values.run_as.user, "gid": values.run_as.group, "mode": "check"} %} |
| 8 | + |
| 9 | +{% do c1.set_user(values.run_as.user, values.run_as.group) %} |
| 10 | +{% do c1.healthcheck.set_test("wget", {"port": values.network.web_port, "path": "/health", "scheme": proto}) %} |
| 11 | +{% do c1.environment.add_user_envs(values.logseq.additional_envs) %} |
| 12 | +{% do c1.configs.add("nginx.conf", nginx_conf(values), "/etc/nginx/conf.d/default.conf") %} |
36 | 13 | {% if values.network.certificate_id %} |
37 | | - private: |
38 | | - content: {{ values.ix_certificates[values.network.certificate_id].privatekey | tojson }} |
39 | | - public: |
40 | | - content: {{ values.ix_certificates[values.network.certificate_id].certificate | tojson }} |
| 14 | + {% set cert = values.ix_certificates[values.network.certificate_id] %} |
| 15 | + {% do c1.configs.add("private", cert.privatekey, values.consts.ssl_key_path) %} |
| 16 | + {% do c1.configs.add("public", cert.certificate, values.consts.ssl_cert_path) %} |
41 | 17 | {% endif %} |
42 | | - nginx.conf: |
43 | | - content: | |
44 | | - server { |
45 | | - {% if values.network.certificate_id %} |
46 | | -
|
47 | | - listen {{ values.network.web_port }} ssl; |
48 | | - ssl_certificate /etc/nginx/certs/tls.crt; |
49 | | - ssl_certificate_key /etc/nginx/certs/tls.key; |
50 | 18 |
|
51 | | - {% else %} |
| 19 | +{% do c1.ports.add_port(values.network.web_port, values.network.web_port) %} |
52 | 20 |
|
53 | | - listen {{ values.network.web_port }}; |
| 21 | +{% set nginx_cache_config = {"type": "temporary", "volume_config": {"volume_name": "nginx-cache"}} %} |
| 22 | +{% set tmp_perms_config = dict(perms_config) %} |
| 23 | +{% do c1.add_storage("/var/cache/nginx", nginx_cache_config) %} |
| 24 | +{% do perm_container.add_or_skip_action("nginx-cache", nginx_cache_config, tmp_perms_config) %} |
54 | 25 |
|
55 | | - {% endif %} |
| 26 | +{% set nginx_run_config = {"type": "temporary", "volume_config": {"volume_name": "nginx-run"}} %} |
| 27 | +{% do c1.add_storage("/var/run", nginx_run_config) %} |
| 28 | +{% do perm_container.add_or_skip_action("nginx-run", nginx_run_config, tmp_perms_config) %} |
56 | 29 |
|
57 | | - error_page 500 502 503 504 /50x.html; |
58 | | - location = /50x.html { |
59 | | - root /usr/share/nginx/html; |
60 | | - } |
61 | | -
|
62 | | - location / { |
63 | | - root /usr/share/nginx/html; |
64 | | - index index.html index.htm; |
65 | | - } |
66 | | -
|
67 | | - location /health { |
68 | | - return 200; |
69 | | - } |
70 | | - } |
71 | | -
|
72 | | -
|
73 | | -{# Containers #} |
74 | | -services: |
75 | | - {{ values.consts.logseq_container_name }}: |
76 | | - user: {{ "%d:%d" | format(values.run_as.user, values.run_as.group) }} |
77 | | - image: {{ ix_lib.base.utils.get_image(images=values.images, name="image") }} |
78 | | - restart: unless-stopped |
79 | | - deploy: |
80 | | - resources: {{ ix_lib.base.resources.resources(values.resources) | tojson }} |
81 | | - devices: {{ ix_lib.base.resources.get_devices(values.resources) | tojson }} |
82 | | - configs: |
83 | | - - source: nginx.conf |
84 | | - target: /etc/nginx/conf.d/default.conf |
85 | | - {% if values.network.certificate_id %} |
86 | | - - source: private |
87 | | - target: /etc/nginx/certs/tls.key |
88 | | - - source: public |
89 | | - target: /etc/nginx/certs/tls.crt |
90 | | - {% endif %} |
91 | | - {% if perms_dirs.items %} |
92 | | - depends_on: |
93 | | - {{ values.consts.perms_container_name }}: |
94 | | - condition: service_completed_successfully |
95 | | - {% endif %} |
96 | | - {% if values.network.host_network %} |
97 | | - network_mode: host |
98 | | - {% endif %} |
99 | | - cap_drop: {{ ix_lib.base.security.get_caps().drop | tojson }} |
100 | | - security_opt: {{ ix_lib.base.security.get_sec_opts() | tojson }} |
101 | | - {% if values.network.dns_opts %} |
102 | | - dns_opt: {{ ix_lib.base.network.dns_opts(values.network.dns_opts) | tojson }} |
103 | | - {% endif %} |
104 | | - {% set test = ix_lib.base.healthchecks.wget_test(port=values.network.web_port, path="/health", config={"scheme": "https" if values.network.certificate_id else "http"}) %} |
105 | | - healthcheck: {{ ix_lib.base.healthchecks.check_health(test) | tojson }} |
106 | | - environment: {{ ix_lib.base.environment.envs(app={}, user=values.logseq.additional_envs, values=values) | tojson }} |
107 | | - {% if not values.network.host_network %} |
108 | | - ports: |
109 | | - - {{ ix_lib.base.ports.get_port(port={"target": values.network.web_port, "published": values.network.web_port}) | tojson }} |
110 | | - {% endif %} |
111 | | - volumes: {{ volume_mounts.items | tojson }} |
112 | | - {% if perms_dirs.items %} |
113 | | - {{ values.consts.perms_container_name }}: {{ ix_lib.base.permissions.perms_container(items=perms_dirs.items, volumes=perms_mounts.items) | tojson }} |
114 | | - {% endif %} |
| 30 | +{% for store in values.storage.additional_storage %} |
| 31 | + {% do c1.add_storage(store.mount_path, store) %} |
| 32 | + {% do perm_container.add_or_skip_action(store.mount_path, store, perms_config) %} |
| 33 | +{% endfor %} |
115 | 34 |
|
116 | | -{% if volumes.items %} |
117 | | -volumes: {{ volumes.items | tojson }} |
| 35 | +{% if perm_container.has_actions() %} |
| 36 | + {% do perm_container.activate() %} |
| 37 | + {% do c1.depends.add_dependency(values.consts.perms_container_name, "service_completed_successfully") %} |
118 | 38 | {% endif %} |
119 | 39 |
|
120 | | -x-portals: {{ ix_lib.base.metadata.get_portals([{"port": values.network.web_port, "scheme": "https" if values.network.certificate_id else "http"}]) | tojson }} |
121 | | -x-notes: {{ ix_lib.base.metadata.get_notes("Logseq") | tojson }} |
| 40 | +{% do tpl.portals.add_portal({"port": values.network.web_port, "scheme": proto}) %} |
| 41 | + |
| 42 | +{{ tpl.render() | tojson }} |
0 commit comments