jeremy
af2b560686
Config at /mnt/docker-data/configs/mas/config.yaml (node-only, holds signing keys). Health on :8021 (distroless image - no container healthcheck possible). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
68 lines
1.9 KiB
YAML
68 lines
1.9 KiB
YAML
services:
|
|
mas-db:
|
|
image: postgres:16-alpine
|
|
container_name: mas-db
|
|
restart: unless-stopped
|
|
environment:
|
|
- POSTGRES_USER=mas
|
|
- POSTGRES_PASSWORD=3XRBtczkPrdbNgdJftKGWu7QwhT3
|
|
- POSTGRES_DB=mas
|
|
volumes:
|
|
# LOCAL disk, never NFS (Known Issue #16)
|
|
- /var/lib/mas-db:/var/lib/postgresql/data
|
|
networks:
|
|
- mas
|
|
mem_limit: 256M
|
|
memswap_limit: 256M
|
|
labels:
|
|
- "com.centurylinklabs.watchtower.enable=false"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U mas -d mas"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "3"
|
|
|
|
mas:
|
|
# NOTE: MAS tags are NOT v-prefixed (1.23.0), unlike Synapse (v1.159.0).
|
|
# Distroless image - no shell, so no container healthcheck is possible.
|
|
# Liveness is covered by the blackbox probe of https://auth.hobbs.farm/health.
|
|
image: ghcr.io/element-hq/matrix-authentication-service:1.23.0
|
|
container_name: mas
|
|
restart: unless-stopped
|
|
command: ["server", "--config", "/config/config.yaml"]
|
|
volumes:
|
|
- /mnt/docker-data/configs/mas:/config:ro
|
|
# read-only synapse data dir: syn2mas reads homeserver.yaml from here
|
|
- /var/lib/synapse:/synapse:ro
|
|
ports:
|
|
- "8020:8080" # web: oauth / compat / discovery / human UI
|
|
- "8021:8081" # internal: /health only
|
|
networks:
|
|
- mas # to mas-db
|
|
- matrix-internal # to synapse (admin API) and back
|
|
depends_on:
|
|
mas-db:
|
|
condition: service_healthy
|
|
mem_limit: 256M
|
|
memswap_limit: 256M
|
|
labels:
|
|
- "com.centurylinklabs.watchtower.enable=false"
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "3"
|
|
|
|
networks:
|
|
mas:
|
|
driver: bridge
|
|
matrix-internal:
|
|
external: true
|
|
name: matrix_matrix-internal
|