Ilia Denisov
2b399d0838
Split the contour across the two prod hosts and retune for the small main host: - Gate vpn+bot to the telegram-local profile. The CI test deploy now passes --profile telegram-local so the test contour still brings them; the prod main host omits both, and the prod bot runs standalone from docker-compose.bot.yml. - docker-compose.prod.yml (main-host overlay): publish caddy 80/443 (no host caddy in prod; caddy owns ACME) and gateway 9443 (the remote bot dials in over mTLS); GOMAXPROCS=2, smaller memory caps and 7d Prometheus retention for the 2 vCPU / 1.9 GiB host. It launches deliberately undersized; resize reactively. - docker-compose.bot.yml: standalone bot for the tg host (no VPN, OTLP off since otelcol is unreachable from there, dials the main host's bot-link). - Add node_exporter + a Prometheus scrape so host memory pressure (the OOM signal on the tight main host), not just per-container docker_stats, is visible. - Soften AWG_CONF to a default: only the profiled vpn sidecar consumes it, and compose interpolates profiled-out services too, so prod must not require it.
54 lines
2.3 KiB
YAML
54 lines
2.3 KiB
YAML
# Production Telegram bot host descriptor (standalone — NOT an overlay). Run only on
|
|
# the bot host:
|
|
# docker compose -f docker-compose.bot.yml up -d
|
|
#
|
|
# The bot egresses to the Bot API directly (no VPN sidecar) and dials the main host's
|
|
# published bot-link :9443 over mTLS. It exports no telemetry — otelcol lives on the
|
|
# main host and is unreachable from here — so observe it via `docker logs` on this host.
|
|
# Values come from the prod-deploy workflow (PROD_ secrets/variables); BOT_IMAGE is the
|
|
# pushed registry tag and BOTLINK_GATEWAY_ADDR is the main host's <ip>:9443.
|
|
name: scrabble-bot
|
|
|
|
services:
|
|
bot:
|
|
container_name: scrabble-telegram-bot
|
|
image: ${BOT_IMAGE:?set BOT_IMAGE to the registry tag}
|
|
restart: unless-stopped
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
environment:
|
|
TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:?set TELEGRAM_BOT_TOKEN}
|
|
TELEGRAM_GAME_CHANNEL_ID: ${TELEGRAM_GAME_CHANNEL_ID:-}
|
|
TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
|
|
TELEGRAM_PROMO_BOT_TOKEN: ${TELEGRAM_PROMO_BOT_TOKEN:-}
|
|
TELEGRAM_BOT_USERNAME: ${TELEGRAM_BOT_USERNAME:-}
|
|
TELEGRAM_BOT_LINK: ${TELEGRAM_BOT_LINK:-}
|
|
TELEGRAM_MINIAPP_URL: ${TELEGRAM_MINIAPP_URL:?set TELEGRAM_MINIAPP_URL}
|
|
# Real Bot API in prod (the test contour pins TELEGRAM_TEST_ENV=true instead).
|
|
TELEGRAM_TEST_ENV: "false"
|
|
TELEGRAM_API_BASE_URL: ${TELEGRAM_API_BASE_URL:-}
|
|
TELEGRAM_OWNS_UPDATES: "true"
|
|
# Dials the main host's published bot-link. ServerName stays `gateway` (the cert
|
|
# SAN), so TLS validation is independent of the dial address.
|
|
TELEGRAM_GATEWAY_ADDR: ${BOTLINK_GATEWAY_ADDR:?set BOTLINK_GATEWAY_ADDR (main:9443)}
|
|
TELEGRAM_BOTLINK_SERVER_NAME: gateway
|
|
TELEGRAM_BOTLINK_TLS_CERT: /certs/bot.crt
|
|
TELEGRAM_BOTLINK_TLS_KEY: /certs/bot.key
|
|
TELEGRAM_BOTLINK_TLS_CA: /certs/ca.crt
|
|
TELEGRAM_LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
TELEGRAM_SERVICE_NAME: scrabble-telegram-bot
|
|
# No telemetry export: otelcol is on the main host, unreachable from here.
|
|
TELEGRAM_OTEL_TRACES_EXPORTER: none
|
|
TELEGRAM_OTEL_METRICS_EXPORTER: none
|
|
GOMAXPROCS: "1"
|
|
volumes:
|
|
- ${SCRABBLE_CONFIG_DIR:-.}/certs:/certs:ro
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "1.0"
|
|
memory: 256M
|