truetype
12d2018ac5
- Dockerfile: build-arg REQUIREMENTS_CHECKSUM verifica lo sha256 del lockfile (fallisce la build se non coincide; vuoto = skip locale) - docker-compose.yml: default = hash corrente del lock - CI: nuovo job checksum.yml che fallisce se il pin non coincide - Fix YAML preesistente in ci.yml (name: con ':' non quotati) - Docs: README, .env.example, review aggiornati
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
services:
|
|
bookish:
|
|
build:
|
|
context: .
|
|
args:
|
|
# Riproducibilita (R4b): sha256 di requirements.lock. Default = hash
|
|
# corrente; in dev puoi sovrascriverlo con REQUIREMENTS_CHECKSUM=""
|
|
REQUIREMENTS_CHECKSUM: ${REQUIREMENTS_CHECKSUM:-d13e4fb14a909e0bd06d20894860152d5334aa341dd9dec2e5e4ca368a0d2a62}
|
|
image: bookish:local
|
|
ports:
|
|
- "${PORT:-5000}:5000"
|
|
environment:
|
|
BOOKISH_SECRET: ${BOOKISH_SECRET:?Copia .env.example in .env e imposta BOOKISH_SECRET}
|
|
BOOKISH_DATA_DIR: /data
|
|
BOOKISH_DEBUG: "false"
|
|
BOOKISH_CLEANUP_HOURS: ${BOOKISH_CLEANUP_HOURS:-1}
|
|
# Sicurezza opzionale
|
|
BOOKISH_AUTH_USERNAME: ${BOOKISH_AUTH_USERNAME:-}
|
|
BOOKISH_AUTH_PASSWORD: ${BOOKISH_AUTH_PASSWORD:-}
|
|
BOOKISH_RATE_LIMIT_UPLOAD: ${BOOKISH_RATE_LIMIT_UPLOAD:-20}
|
|
PORT: "5000"
|
|
volumes:
|
|
- bookish-data:/data
|
|
restart: unless-stopped
|
|
mem_limit: 1g
|
|
cpus: "1.0"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
tmpfs:
|
|
- /tmp
|
|
stop_grace_period: 30s
|
|
|
|
volumes:
|
|
bookish-data:
|