39 lines
997 B
INI
39 lines
997 B
INI
[Unit]
|
|
Description=dev-blog Astro application (node:24-trixie-slim)
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Container]
|
|
ContainerName=dev-blog-app
|
|
# Built from the Containerfile at the repo root.
|
|
# Build with: podman build -t localhost/dev-blog-app:latest .
|
|
Image=localhost/dev-blog-app:latest
|
|
|
|
Network=dev-blog.network
|
|
NetworkAlias=app
|
|
|
|
Environment=NODE_ENV=production
|
|
Environment=HOST=0.0.0.0
|
|
Environment=PORT=4321
|
|
Environment=ASTRO_TELEMETRY_DISABLED=1
|
|
Environment=DISABLE_GCP_LOGGING=true
|
|
|
|
# Hardening
|
|
NoNewPrivileges=true
|
|
ReadOnly=true
|
|
DropCapability=ALL
|
|
Tmpfs=/tmp:rw,size=64m,mode=1777
|
|
|
|
# Caddy now runs on the host network namespace, so it cannot reach the app
|
|
# via podman DNS (`app:4321`). Publish the app port on the host's *loopback*
|
|
# only -- it is reachable to Caddy on the host but not from outside.
|
|
PublishPort=127.0.0.1:4321:4321
|
|
PublishPort=[::1]:4321:4321
|
|
|
|
[Service]
|
|
Restart=on-failure
|
|
TimeoutStartSec=120
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target default.target
|