Initial server source import

2026-09-30 20:30:56 +03:00
commit 170dd941b9
498 changed files with 261563 additions and 0 deletions
@@ -0,0 +1,109 @@
+name: truf-docker
+
+x-runtime: &runtime
+  image: truf-local:runtime
+  build:
+    context: .
+    target: runtime
+  read_only: true
+  user: "10001:10001"
+  cap_drop: [ALL]
+  security_opt: [no-new-privileges:true]
+  volumes:
+    - data:/data
+  tmpfs:
+    - /run/truf:rw,nosuid,nodev,noexec,size=64m,mode=0700,uid=10001,gid=10001
+    - /tmp:rw,nosuid,nodev,noexec,size=128m,mode=1777
+  cpus: 2.0
+  mem_limit: 6g
+  pids_limit: 512
+  shm_size: 256m
+  stop_signal: SIGTERM
+  stop_grace_period: 10m
+  logging:
+    driver: json-file
+    options:
+      max-size: "16m"
+      max-file: "4"
+
+services:
+  provision:
+    <<: *runtime
+    user: "0:0"
+    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER]
+    network_mode: none
+    command: [provision]
+    restart: "no"
+
+  runtime:
+    <<: *runtime
+    volumes:
+      - type: volume
+        source: data
+        target: /data
+      - type: bind
+        source: /etc/truf/runtime
+        target: /data/config
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /etc/truf/worker-packages
+        target: /data/worker-packages
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /var/lib/truf/runtime-document-candidates
+        target: /data/runtime-document-candidates
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /run/truf/host-agent.sock
+        target: /run/truf/host-agent.sock
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /var/lib/truf/host-agent/results
+        target: /data/host-agent-results
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /run/truf-postgres
+        target: /run/truf-postgres
+        bind:
+          create_host_path: false
+    depends_on:
+      provision:
+        condition: service_completed_successfully
+    command: [run, --config, /data/config/config.yaml]
+    restart: "on-failure:3"
+    healthcheck:
+      test: [CMD, /usr/local/bin/python3, -I, -S, -B, /opt/truf/app/container_runtime.py, health, --config, /data/config/config.yaml]
+      interval: 30s
+      timeout: 15s
+      start_period: 240s
+      retries: 3
+
+  test:
+    image: truf-local:test
+    build:
+      context: .
+      target: test
+    profiles: [test]
+    read_only: true
+    user: "10001:10001"
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    network_mode: none
+    tmpfs:
+      # These tests intentionally execute temporary venv and askpass fixtures.
+      - /tmp:rw,exec,nosuid,nodev,size=512m,mode=1777
+    cpus: 2.0
+    mem_limit: 3g
+    pids_limit: 512
+
+volumes:
+  data: