kami
9190f897a3
The template's wildcard `listen 80` with no ACL was fixed in 50cc17f, but it
still only covered nexus/praxis/hexis. mavweb — the one service in the set
that serves an RCE surface (POST /tools defines argv internal/tool executes)
— had no block at all, so anyone wiring it up wrote their own, which is how
the wildcard got there the first time.
Adds a maven.kvmx.ru server with the same wg+LAN bind and allow/deny,
proxying 127.0.0.1:9201, with the WebSocket upgrade /ws needs, a 32m body
limit for push-to-talk PCM, and a 300s read timeout because an LLM turn on
the iGPU is slow.
Also records in deploy/ecosystem/docker-compose.yml that the sibling
`build:` paths pin nothing and ship the sibling working tree, with the
command to check what is about to be deployed. The stale public DNS records
(item 2) are outside the repo.
Verified: nginx -t on the template inside a minimal http{} accepts it.
67 lines
2.5 KiB
YAML
67 lines
2.5 KiB
YAML
# Nexus / Praxis / Hexis — the three sibling services Maven coordinates.
|
|
# One container each, built from the sibling repos (siblings of the Maven repo
|
|
# on the same mount). HTTP is published to 127.0.0.1 so the host nginx can
|
|
# reverse-proxy the *.subdomains; container-to-container (Maven → sibling) goes
|
|
# over the shared `ecosystem` network by service name, no host round-trip.
|
|
#
|
|
# docker compose -f deploy/ecosystem/docker-compose.yml up -d --build
|
|
#
|
|
# Maven's own compose joins this same network (add `ecosystem` as an external
|
|
# network there) to reach nexus:9740 / praxis:8989 / hexis:9741 directly.
|
|
#
|
|
# NO RELEASE PINNING (Vikunja #354): each `build:` below points at a sibling
|
|
# WORKING TREE, so `up --build` ships whatever is checked out there, including
|
|
# uncommitted edits. Before bringing this up, check what you are about to
|
|
# deploy:
|
|
#
|
|
# for r in nexus praxis hexis; do git -C ../../../$r status --short; \
|
|
# git -C ../../../$r log -1 --oneline; done
|
|
#
|
|
# The host nginx that fronts these is deploy/ecosystem/nginx.conf — it binds
|
|
# the wg and LAN addresses only, with allow/deny. Keep it that way: none of
|
|
# these containers has auth of its own.
|
|
name: ecosystem
|
|
|
|
services:
|
|
nexus:
|
|
build: ../../../nexus
|
|
restart: unless-stopped
|
|
ports: ["127.0.0.1:9740:9740"] # host nginx → nexus.<domain>
|
|
volumes:
|
|
- nexus-data:/data
|
|
- sockets:/run/ecosystem # nexus.sock, shared with Maven
|
|
networks: [ecosystem]
|
|
|
|
praxis:
|
|
build: ../../../praxis
|
|
restart: unless-stopped
|
|
ports: ["127.0.0.1:8989:8989"] # host nginx → praxis.<domain>
|
|
volumes:
|
|
- praxis-data:/data
|
|
networks: [ecosystem]
|
|
|
|
hexis:
|
|
build: ../../../hexis
|
|
restart: unless-stopped
|
|
ports: ["127.0.0.1:9741:9741"] # host nginx → hexis.<domain> (MCP moved off hexis.*)
|
|
environment:
|
|
# hexis fronts the workspace MCP; point at wherever it listens on the
|
|
# host/network. Empty ⇒ workspace provider disabled (systemd-only).
|
|
- WORKSPACE_MCP_URL=${WORKSPACE_MCP_URL:-http://192.168.1.104:9930}
|
|
volumes:
|
|
- hexis-data:/data
|
|
- sockets:/run/ecosystem
|
|
# required when WORKSPACE_MCP_URL is set — hexisd fatals without it.
|
|
- ../../../hexis/etc/workspace-allowlist.yaml:/data/workspace-allowlist.yaml:ro
|
|
networks: [ecosystem]
|
|
|
|
volumes:
|
|
nexus-data:
|
|
praxis-data:
|
|
hexis-data:
|
|
sockets:
|
|
|
|
networks:
|
|
ecosystem:
|
|
name: ecosystem # stable name so Maven's compose can reference it as external
|