38 lines
1.7 KiB
YAML
38 lines
1.7 KiB
YAML
# HostStack native Rust deployment for MessageWeave.
|
|
#
|
|
# Set REDIS_URL and CONFIG_ENCRYPTION_KEY as encrypted HostStack dashboard
|
|
# secrets; never put their values in this repository.
|
|
#
|
|
# Business config (JMAP URL + credentials, Telegram bot token, worker token,
|
|
# chat allowlist, LLM settings) is NOT read from environment variables at all.
|
|
# It is written to Redis via /api/bootstrap or admin PUT on /api/config.
|
|
#
|
|
# Container rootfs is read-only, so diagnostic tools must be installed at image
|
|
# build time (see the `runtime` stage of Dockerfile): curl, procps (ps/pgrep),
|
|
# iproute2 (ss/ip), jq, bind9-dnsutils (dig), netcat-openbsd (nc).
|
|
services:
|
|
web:
|
|
type: web_service
|
|
runtime: rust
|
|
install:
|
|
command: cargo fetch --locked
|
|
build:
|
|
command: cargo build --release --locked
|
|
start:
|
|
# Binary is named after the Cargo package: `message-weave`, not `app`.
|
|
# Do NOT add --debug here for production.
|
|
command: ./target/release/message-weave
|
|
# Temporary diagnosis only: change the line above to
|
|
# command: ./target/release/message-weave --debug
|
|
# and set the DEBUG_TOKEN secret. Then probe the debug surface from
|
|
# inside the container, never through the public domain:
|
|
# curl -s -i -H "Authorization: Bearer <token>" http://127.0.0.1:8080/debug/config
|
|
# Debug routes are gated by BOTH factors (see docs/deployment.md §2.1).
|
|
healthCheck:
|
|
# /healthz only, never /ready. /ready also probes redis, the JMAP session
|
|
# and Telegram getMe, so a transient upstream blip would restart the
|
|
# container. See docs/deployment.md §2.1.
|
|
path: /healthz
|
|
interval: 30
|
|
timeout: 5
|