linumiq_net-user
7fe0cc3753
Near-1:1 clone of the prod remote-access stack, isolated on a new external dev_edge network and fronted by the same shared Caddy instance (dual-homed on edge + dev_edge). Dev is manual-start (not on boot). - Hostnames: app-dev / api-dev .linumiq.net, tunnels under *.dev.linumiq.net, dev tunnel ingress on port 7001. - Dev Supabase (project supabase-dev, *-dev containers), web, frps, redis, stripe-stub, bandwidth-worker with fresh independent secrets (gitignored). - Shared Caddyfile: app-dev -> web-dev, api-dev -> dev kong (+webhook block), *.dev -> frps-dev vhost. Caddy compose dual-homed on dev_edge. - On-demand-TLS authorizer (prod check-subdomain, in gitignored volumes/) extended additively: app-dev/api-dev -> 200; *.dev delegated to the dev authorizer. Prod allow-list logic unchanged. - dev.sh manual up/down/ps helper; README documents topology + secrets. Secrets, frps.toml, volumes/, web worktree and data dirs are gitignored.
45 lines
929 B
YAML
45 lines
929 B
YAML
name: redis-dev
|
|
services:
|
|
redis:
|
|
image: redis:7.2-alpine
|
|
container_name: redis-dev
|
|
restart: unless-stopped
|
|
# SECURITY (R4/I7): drop privileges and disable destructive admin commands.
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
environment:
|
|
REDIS_PASSWORD: ${REDIS_PASSWORD}
|
|
command:
|
|
- redis-server
|
|
- --requirepass
|
|
- ${REDIS_PASSWORD}
|
|
- --appendonly
|
|
- "yes"
|
|
- --appendfsync
|
|
- everysec
|
|
- --rename-command
|
|
- FLUSHALL
|
|
- ""
|
|
- --rename-command
|
|
- FLUSHDB
|
|
- ""
|
|
- --rename-command
|
|
- KEYS
|
|
- ""
|
|
- --rename-command
|
|
- DEBUG
|
|
- ""
|
|
volumes:
|
|
- ./data:/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "redis-cli -a \"$$REDIS_PASSWORD\" PING | grep -q PONG"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 5
|
|
networks:
|
|
- dev_edge
|
|
|
|
networks:
|
|
dev_edge:
|
|
external: true
|