Ilia Denisov
f5f45e7afb
Idempotent playbooks under deploy/ansible/ prepare both production hosts: docker-ce + compose plugin, a non-sudo deploy service account holding the CI deploy key, key-only sshd, default-deny ufw, fail2ban, unattended upgrades and chrony. The main host also opens 80/443/9443 and creates the external edge network; the tg host verifies direct Bot API egress (the no-VPN assumption). The application is deployed separately by the prod-deploy workflow (later phase), running as the deploy account this playbook provisions.
9 lines
166 B
Django/Jinja
9 lines
166 B
Django/Jinja
{
|
|
"live-restore": true,
|
|
"log-driver": "json-file",
|
|
"log-opts": {
|
|
"max-size": "{{ docker_log_max_size }}",
|
|
"max-file": "{{ docker_log_max_file }}"
|
|
}
|
|
}
|