TMCandClaude Opus 5.5
c58cc329b0
docker-compose.yml runs HODA on the main host, published on one address (10.20.30.10:10040 in .env.example) for the Pangolin resource. The agent settings are optional, so a single host needs nothing else. docker-compose.agent.yml is for a second Docker host. Both follow FiMa's layout: required values fail with a clear message, pull_policy always, memory limits, capped logs, a read-only root filesystem. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
# HODA — a second Docker host, the agent: reports this host's labeled apps and their icons to
|
|
# the dashboard on the main host (docker-compose.yml). It serves no dashboard of its own, and a
|
|
# setup with one host doesn't need it.
|
|
#
|
|
# Usage:
|
|
# cp .env.agent.example .env # then set HODA_PEER_TOKEN and HODA_AGENT_BIND_IP
|
|
# docker compose -f docker-compose.agent.yml pull
|
|
# docker compose -f docker-compose.agent.yml up -d
|
|
#
|
|
# The main host's HODA_AGENT_URL must point here: http://<HODA_AGENT_BIND_IP>:<HODA_AGENT_PORT>,
|
|
# with the same HODA_PEER_TOKEN.
|
|
|
|
name: hoda-agent
|
|
|
|
x-logging: &logging
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
services:
|
|
hoda-agent:
|
|
image: git.mariosem.es/msemes/hoda:${HODA_TAG:-latest}
|
|
container_name: hoda-agent
|
|
restart: unless-stopped
|
|
# `:latest` is mutable; `always` makes `docker compose up -d` check the registry for a newer
|
|
# image. If you pin HODA_TAG to a fixed tag, `missing` is enough.
|
|
pull_policy: always
|
|
depends_on:
|
|
- socket-proxy
|
|
environment:
|
|
MODE: agent
|
|
DOCKER_HOST: tcp://socket-proxy:2375
|
|
NODE_NAME: ${HODA_NODE_NAME:-host-2}
|
|
PEER_TOKEN: ${HODA_PEER_TOKEN:?HODA_PEER_TOKEN must be set in .env (the same value as on the main host).}
|
|
LOG_LEVEL: ${HODA_LOG_LEVEL:-info}
|
|
ports:
|
|
# Published on the LAN IP only, and every request needs the peer token as well.
|
|
- "${HODA_AGENT_BIND_IP:?HODA_AGENT_BIND_IP must be set in .env to this host's LAN IP (e.g. 10.20.30.11).}:${HODA_AGENT_PORT:-8081}:8080"
|
|
volumes:
|
|
# Icon cache. Set HODA_DATA_DIR to bind-mount a host directory instead of the named volume;
|
|
# it must be owned by the image's user first: sudo chown -R 65532:65532 /path/to/dir
|
|
- ${HODA_DATA_DIR:-hoda_data}:/data
|
|
# The binary only writes to /data, and needs no privileges.
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
security_opt: ["no-new-privileges:true"]
|
|
mem_limit: 128m
|
|
cpus: 0.5
|
|
logging: *logging
|
|
|
|
# Read-only Docker API for HODA: container lists and events, nothing else. No published port.
|
|
socket-proxy:
|
|
image: tecnativa/docker-socket-proxy:latest
|
|
container_name: hoda-agent-socket-proxy
|
|
restart: unless-stopped
|
|
environment:
|
|
CONTAINERS: 1
|
|
EVENTS: 1
|
|
POST: 0
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
mem_limit: 64m
|
|
logging: *logging
|
|
|
|
volumes:
|
|
# Fallback when HODA_DATA_DIR is unset; a no-op if /data is bind-mounted to a host path.
|
|
hoda_data:
|