Alphaeus Mote
300866d5cf
Add internal/tlsmgr: on startup, load-or-generate the CA, issue/reuse the leaf, export the chain under <data>/tls, and hot-swap the cert on renewal via GetCertificate. The server listens HTTPS when a manager is present. TLS is on by default for the standalone binary/service (tls.enabled setting or ORCHESTRAD_TLS_ENABLED, UI wins over env); the container image defaults it off so it runs plain HTTP behind a TLS-terminating proxy. Startup logs a clickable URL. Verified end to end: HTTPS serves, plain HTTP rejected, disable serves HTTP. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
38 lines
1.0 KiB
YAML
38 lines
1.0 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
orchestrad:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
VERSION: ${VERSION:-dev}
|
|
BUILD_TIME: ${BUILD_TIME:-unknown}
|
|
GIT_COMMIT: ${GIT_COMMIT:-unknown}
|
|
image: orchestrad:latest
|
|
container_name: orchestrad
|
|
restart: unless-stopped
|
|
ports:
|
|
- "18090:18090"
|
|
volumes:
|
|
- orchestrad-data:/data
|
|
environment:
|
|
- ORCHESTRAD_DATA_PATH=/data
|
|
- ORCHESTRAD_LOG_LEVEL=info
|
|
- ORCHESTRAD_SECRET_KEY=${ORCHESTRAD_SECRET_KEY:-}
|
|
- ORCHESTRAD_HOST=0.0.0.0
|
|
- ORCHESTRAD_PORT=18090
|
|
# Plain HTTP by default (terminate TLS at your ingress/proxy). Set to true
|
|
# to have the container manage its own self-signed certificate.
|
|
- ORCHESTRAD_TLS_ENABLED=false
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:18090/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
volumes:
|
|
orchestrad-data:
|
|
driver: local
|