2024-01-05 14:32:35 +01:00
job "miniflux" {
datacenters = [ "dc1" ]
2024-02-17 22:43:07 +01:00
region = "global"
2024-01-05 14:32:35 +01:00
2024-03-27 11:58:37 +01:00
2024-01-05 14:32:35 +01:00
group "miniflux" {
count = 1
network {
mode = "bridge"
}
ephemeral_disk {
size = 101
}
service {
name = "miniflux"
port = 8085
2024-03-26 10:54:24 +01:00
meta {
2024-03-27 11:58:37 +01:00
alloc = "${NOMAD_ALLOC_INDEX}"
datacenter = "${NOMAD_DC}"
group = "${NOMAD_GROUP_NAME}"
job = "${NOMAD_JOB_NAME}"
namespace = "${NOMAD_NAMESPACE}"
node = "${node.unique.name}"
region = "${NOMAD_REGION}"
2024-03-26 10:54:24 +01:00
}
2024-01-05 14:32:35 +01:00
connect {
sidecar_service {
proxy {
upstreams {
destination_name = "postgres"
local_bind_port = 5432
2024-02-13 10:02:13 +01:00
# Work arround, see https://github.com/hashicorp/nomad/issues/18538
destination_type = "service"
2024-01-05 14:32:35 +01:00
}
}
}
sidecar_task {
2024-01-26 22:16:47 +01:00
config {
args = [
"-c" ,
"${NOMAD_SECRETS_DIR}/envoy_bootstrap.json" ,
"-l" ,
"${meta.connect.log_level}" ,
"--concurrency" ,
"${meta.connect.proxy_concurrency}" ,
"--disable-hot-restart"
]
}
2024-01-05 14:32:35 +01:00
resources {
cpu = 50
memory = 64
}
}
}
check {
type = "http"
path = "/healthcheck"
expose = true
interval = "10s"
timeout = "3s"
check_restart {
limit = 20
grace = "20s"
}
}
tags = [
2024-01-26 23:42:43 +01:00
2024-01-05 14:32:35 +01:00
"traefik.enable = true " ,
"traefik.http.routers.miniflux.entrypoints = https " ,
2024-01-31 15:07:04 +01:00
"traefik.http.routers.miniflux.rule = Host ( ` flux . example . org ` ) " ,
"traefik.http.middlewares.csp-miniflux.headers.contentsecuritypolicy = default - src ' self ' ; font - src ' self ' data : ; img - src ' self ' data : ; script - src ' self ' ' unsafe - inline ' ' unsafe - eval ' ; style - src ' self ' ' unsafe - inline ' ; " ,
"traefik.http.routers.miniflux.middlewares = security - headers @ file , rate - limit - std @ file , forward - proto @ file , inflight - std @ file , hsts @ file , compression @ file , csp - miniflux " ,
2024-01-26 23:42:43 +01:00
2024-01-05 14:32:35 +01:00
]
}
2024-01-26 22:16:47 +01:00
2024-01-05 14:32:35 +01:00
# wait for required services tp be ready before starting the main task
task "wait-for" {
driver = "docker"
user = 1053
config {
2024-03-05 14:59:35 +01:00
image = "danielberteaud/wait-for:24.3-1"
2024-01-05 14:32:35 +01:00
readonly_rootfs = true
pids_limit = 20
}
lifecycle {
hook = "prestart"
}
env {
SERVICE_0 = "master.postgres.service.consul"
}
resources {
cpu = 10
memory = 10
memory_max = 30
}
}
2024-01-09 11:05:19 +01:00
2024-01-05 14:32:35 +01:00
task "miniflux" {
driver = "docker"
config {
2024-03-11 09:17:07 +01:00
image = "danielberteaud/miniflux:2.1.1-1"
2024-01-05 14:32:35 +01:00
pids_limit = 100
readonly_rootfs = true
}
2024-01-09 11:05:19 +01:00
2024-01-05 14:32:35 +01:00
vault {
policies = [ "miniflux" ]
env = false
disable_file = true
2024-02-11 22:52:01 +01:00
change_mode = "noop"
2024-01-05 14:32:35 +01:00
}
2024-01-09 11:05:19 +01:00
2024-01-05 14:32:35 +01:00
env {
LISTEN_ADDR = "127.0.0.1:8085"
BASE_URL = "https://flux.example.org"
}
2024-01-09 11:05:19 +01:00
template {
data = < < _EOT
2024-03-05 14:59:35 +01:00
DATABASE_URL = postgresql://{{ with secret "database/creds/miniflux" }}{{ .Data.username }}{{ end }}:{{ with secret "database/creds/miniflux" }}{{ urlquery .Data.password }}{{ end }}@127.0.0.1:5432/miniflux?sslmode = disable
2024-01-09 11:05:19 +01:00
_EOT
destination = "secrets/.db.env"
perms = 400
env = true
}
2024-03-26 10:54:24 +01:00
2024-01-05 14:32:35 +01:00
# Use a template block instead of env {} so we can fetch values from vault
template {
data = < < _EOT
LANG = fr_FR . utf8
TZ = Europe / Paris
_EOT
destination = "secrets/.env"
perms = 400
env = true
}
resources {
cpu = 50
memory = 192
}
}
}
}