b0txec
1086c8b548
The ltv account fails to authenticate from the VPS specifically (works fine from Rocky with the same credentials, network path to ftp.meteo.lv:21 confirmed fine from the VPS too) — narrowed to either a password transcription error in .env.staging or LVGMC IP-allowlisting the account, neither confirmable without inspecting the password. Caught via the overnight watch this was set up for rather than assumed safe; reverted ENABLE_LVGMC_FTP_JOBS to false on the VPS immediately once the failure was confirmed real, restoring stable operation. FTP stays enabled on Rocky, where it works.
92 lines
3.1 KiB
YAML
92 lines
3.1 KiB
YAML
name: weathertool-uat
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16.1
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env.staging}
|
|
POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env.staging}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env.staging}
|
|
volumes:
|
|
- ./data/postgres:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
networks:
|
|
- backend
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
app:
|
|
image: ${WEATHERTOOL_IMAGE:?set WEATHERTOOL_IMAGE in .env.staging}
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_HOST: postgres
|
|
ENABLE_SCHEDULED_JOBS: "true"
|
|
# Briefly "true" on 2026-08-23, reverted same night: the ltv account
|
|
# fails to authenticate from the VPS specifically (works fine from
|
|
# Rocky), which crash-looped the whole app in-process via parMapN
|
|
# before this was caught and reverted. Leave false until the VPS-side
|
|
# auth failure is diagnosed and re-verified — see docs/UPDATE_ROADMAP.md.
|
|
ENABLE_LVGMC_FTP_JOBS: "false"
|
|
ENABLE_HARMONIE_JOBS: "false"
|
|
DEBUG: "false"
|
|
# LVGMC_* read real values from .env.staging (real FTP credentials
|
|
# obtained 2026-08-23). HARMONIE stays on inert placeholders until real
|
|
# DMI credentials exist — the provider service is still constructed at
|
|
# startup even with its scheduled job off, so it needs some value.
|
|
LVGMC_USER: ${LVGMC_USER}
|
|
LVGMC_PASSWORD: ${LVGMC_PASSWORD}
|
|
LVGMC_URL: ${LVGMC_URL}
|
|
HARMONIE_EDR_API_KEY: disabled
|
|
HARMONIE_EDR_URL: https://invalid.local/
|
|
HARMONIE_STAC_API_KEY: disabled
|
|
HARMONIE_STAC_URL: https://invalid.local/
|
|
ports:
|
|
- "127.0.0.1:${WEATHERTOOL_PORT:-8002}:8080"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=64m,mode=1777
|
|
- /app/data:size=256m,mode=0770,uid=100,gid=101
|
|
networks:
|
|
- backend
|
|
- edge
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
authelia:
|
|
image: authelia/authelia:4.39.20
|
|
restart: unless-stopped
|
|
environment:
|
|
AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /run/secrets/jwt_secret
|
|
AUTHELIA_SESSION_SECRET_FILE: /run/secrets/session_secret
|
|
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /run/secrets/storage_encryption_key
|
|
ports:
|
|
- "127.0.0.1:${AUTHELIA_PORT:-9091}:9091"
|
|
volumes:
|
|
- ./config/authelia:/config:ro
|
|
- ./data/authelia:/var/lib/authelia
|
|
- ./secrets/jwt_secret:/run/secrets/jwt_secret:ro
|
|
- ./secrets/session_secret:/run/secrets/session_secret:ro
|
|
- ./secrets/storage_encryption_key:/run/secrets/storage_encryption_key:ro
|
|
networks:
|
|
- edge
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
networks:
|
|
backend:
|
|
driver: bridge
|
|
internal: true
|
|
edge:
|
|
driver: bridge
|