Gordon Zimm
996490075a
Die Vorlage ist fuer alle Kunden identisch und traegt genau einen Platzhalter (__FQDN__); bin/espo-compose-rendern setzt ihn ein und schreibt /srv/espo/docker-compose.yml. Keine .env mehr: alles ausser den Geheimnissen steht in der Compose selbst. Inhalt der Vorlage: Bind-Mounts unter /srv/espo, Datei-Secrets fuer die beiden MariaDB-Passwoerter, Record-IDs als uuid4/36 ueber configs (in allen drei EspoCRM-Diensten, weil configs nicht ueber volumes_from vererbt werden), adminUpgradeDisabled, WebSocket ueber wss://<fqdn>/wss, Healthchecks mit Startfenstern fuer den Migrationslauf. ESPO-02 setzt keine abweichende Bindeadresse mehr - die Ports muessen fuer den Reverse Proxy erreichbar sein. Stattdessen beschraenkt eine DOCKER-USER-Regel den Zugang auf das eigene Subnetz, das die VM selbst ermittelt; eine systemd-Unit setzt sie nach jedem Docker-Start neu. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
129 lines
3.7 KiB
YAML
129 lines
3.7 KiB
YAML
# Vorlage fuer die Kunden-VM. Einziger kundenspezifischer Wert: __FQDN__.
|
|
# Gerendert von bin/espo-compose-rendern nach /srv/espo/docker-compose.yml.
|
|
# Aenderungen ausschliesslich hier im Repository, nie auf der VM.
|
|
name: espocrm
|
|
|
|
services:
|
|
|
|
espocrm-db:
|
|
image: mariadb:12.3
|
|
container_name: espocrm-db
|
|
restart: unless-stopped
|
|
stop_grace_period: 120s
|
|
security_opt: ["no-new-privileges:true"]
|
|
environment:
|
|
MARIADB_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
|
|
MARIADB_DATABASE: espocrm
|
|
MARIADB_USER: espocrm
|
|
MARIADB_PASSWORD_FILE: /run/secrets/db_password
|
|
MARIADB_AUTO_UPGRADE: "1"
|
|
TZ: Europe/Berlin
|
|
secrets: [db_root_password, db_password]
|
|
volumes:
|
|
- /srv/espo/mariadb:/var/lib/mysql
|
|
healthcheck:
|
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
|
interval: 20s
|
|
start_period: 60s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
espocrm:
|
|
image: espocrm:10.0.8
|
|
container_name: espocrm
|
|
restart: unless-stopped
|
|
stop_grace_period: 30s
|
|
security_opt: ["no-new-privileges:true"]
|
|
depends_on:
|
|
espocrm-db:
|
|
condition: service_healthy
|
|
environment:
|
|
ESPOCRM_DATABASE_PLATFORM: Mysql
|
|
ESPOCRM_DATABASE_HOST: espocrm-db
|
|
ESPOCRM_DATABASE_NAME: espocrm
|
|
ESPOCRM_DATABASE_USER: espocrm
|
|
ESPOCRM_DATABASE_PASSWORD_FILE: /run/secrets/db_password
|
|
ESPOCRM_ADMIN_USERNAME: admin
|
|
ESPOCRM_ADMIN_PASSWORD: admin
|
|
ESPOCRM_SITE_URL: https://__FQDN__
|
|
ESPOCRM_CONFIG_SITE_URL: https://__FQDN__
|
|
ESPOCRM_CONFIG_ADMIN_UPGRADE_DISABLED: "true"
|
|
ESPOCRM_CONFIG_USE_WEB_SOCKET: "true"
|
|
ESPOCRM_CONFIG_WEB_SOCKET_URL: wss://__FQDN__/wss
|
|
ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBSCRIBER_DSN: "tcp://*:7777"
|
|
ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBMISSION_DSN: tcp://espocrm-websocket:7777
|
|
TZ: Europe/Berlin
|
|
secrets: [db_password]
|
|
configs:
|
|
- source: recordId
|
|
target: /var/www/html/custom/Espo/Custom/Resources/metadata/app/recordId.json
|
|
volumes:
|
|
- /srv/espo/data:/var/www/html/data
|
|
- /srv/espo/custom:/var/www/html/custom
|
|
- /srv/espo/client-custom:/var/www/html/client/custom
|
|
ports:
|
|
- 8080:80
|
|
healthcheck:
|
|
test: ["CMD", "bin/command", "app-check"]
|
|
start_period: 300s
|
|
interval: 60s
|
|
timeout: 20s
|
|
retries: 3
|
|
|
|
espocrm-daemon:
|
|
image: espocrm:10.0.8
|
|
container_name: espocrm-daemon
|
|
restart: unless-stopped
|
|
entrypoint: docker-daemon.sh
|
|
security_opt: ["no-new-privileges:true"]
|
|
environment:
|
|
TZ: Europe/Berlin
|
|
volumes_from: [espocrm]
|
|
configs:
|
|
- source: recordId
|
|
target: /var/www/html/custom/Espo/Custom/Resources/metadata/app/recordId.json
|
|
depends_on:
|
|
espocrm:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "bin/command", "app-check"]
|
|
start_period: 60s
|
|
interval: 180s
|
|
timeout: 20s
|
|
retries: 3
|
|
|
|
espocrm-websocket:
|
|
image: espocrm:10.0.8
|
|
container_name: espocrm-websocket
|
|
restart: unless-stopped
|
|
entrypoint: docker-websocket.sh
|
|
security_opt: ["no-new-privileges:true"]
|
|
environment:
|
|
TZ: Europe/Berlin
|
|
volumes_from: [espocrm]
|
|
configs:
|
|
- source: recordId
|
|
target: /var/www/html/custom/Espo/Custom/Resources/metadata/app/recordId.json
|
|
depends_on:
|
|
espocrm:
|
|
condition: service_healthy
|
|
ports:
|
|
- 8081:8080
|
|
healthcheck:
|
|
test: ["CMD", "bin/command", "app-check"]
|
|
start_period: 60s
|
|
interval: 180s
|
|
timeout: 20s
|
|
retries: 3
|
|
|
|
secrets:
|
|
db_root_password:
|
|
file: /srv/espo/secrets/db_root_password
|
|
db_password:
|
|
file: /srv/espo/secrets/db_password
|
|
|
|
configs:
|
|
recordId:
|
|
content: |
|
|
{"type": "uuid4", "length": 36}
|