Logan Cusano
6140dd7b9c
docker-compose.prod.yml: compose merges `ports` by appending, so the prod override left the base file's 8888:8000 and 3000:3000 in place next to the 127.0.0.1-scoped ones. Each container tried to bind its port twice and the second bind failed with "address already in use", so c2-core and frontend could never start. It also meant the localhost-only binding never applied — both ports were published on every interface. Marked both `!override`, the same way mosquitto already used `!reset`. infra/ansible: - add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified a handler that did not exist, which aborts the play - guard mkswap/swapon on whether /swapfile is already active, so a second run does not fail on "mounted" / "Device or resource busy" - git task now updates instead of clone-once, otherwise a re-run redeploys whatever code was on the VM at first clone - vault.yml.example: correct the registry token comment to read-only scope Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
# Production overrides — used on the VM.
|
|
# Run with: docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
|
|
#
|
|
# Differences from dev:
|
|
# - MQTT port 1883 is NOT published to the host (stays on the Docker bridge).
|
|
# Edge nodes reach it via WireGuard tunnel to the Docker bridge IP.
|
|
# - c2-core and frontend ports are only bound to localhost (Caddy proxies them).
|
|
# - restart: always (instead of unless-stopped) for hard reboots.
|
|
|
|
services:
|
|
mosquitto:
|
|
restart: always
|
|
ports: !reset [] # Remove the dev 1883:1883 mapping — internal only
|
|
|
|
# !override, not a plain list: compose MERGES `ports` by appending, so a plain
|
|
# list leaves the base file's "8888:8000" in place alongside this one. The
|
|
# container then tries to bind 8888 twice — 0.0.0.0 and 127.0.0.1 — and the
|
|
# second bind fails with "address already in use". It also silently defeated
|
|
# the whole point of this override, publishing the port on every interface.
|
|
c2-core:
|
|
restart: always
|
|
ports: !override
|
|
- "127.0.0.1:8888:8000" # Caddy proxies, not exposed publicly
|
|
|
|
discord-bot:
|
|
restart: always
|
|
|
|
frontend:
|
|
restart: always
|
|
ports: !override
|
|
- "127.0.0.1:3000:3000" # Caddy proxies, not exposed publicly
|