90 lines
2.7 KiB
YAML
90 lines
2.7 KiB
YAML
services:
|
|
k3s-server:
|
|
image: rancher/k3s:v1.36.2-k3s1
|
|
container_name: k3s-server
|
|
command:
|
|
- server
|
|
- --tls-san=127.0.0.1
|
|
- --tls-san=k3s-server
|
|
- --tls-san=${K3S_API_HOST:-127.0.0.1} # внешний IP/домен для доступа к apiserver извне
|
|
- --disable=traefik
|
|
privileged: true
|
|
cgroup: host # kubelet в cgroup v2 (Ubuntu 22.04+/RedOS)
|
|
restart: unless-stopped
|
|
environment:
|
|
K3S_TOKEN: ${K3S_TOKEN:-supersecrettoken}
|
|
K3S_KUBECONFIG_OUTPUT: /output/kubeconfig.yaml
|
|
K3S_KUBECONFIG_MODE: "644"
|
|
ports:
|
|
- "6443:6443" # kube-apiserver — доступен извне; ОБЯЗАТЕЛЬНО ограничь фаерволом до доверенных IP
|
|
- "80:80" # ingress http — задействуются после установки ingress-контроллера
|
|
- "443:443" # ingress https
|
|
volumes:
|
|
- k3s-server-data:/var/lib/rancher/k3s # etcd/state, образы, манифесты — только named volume
|
|
- ./k3s:/output:z # отсюда забираем контекст k8s (:z — SELinux label для RedOS)
|
|
tmpfs:
|
|
- /run
|
|
- /var/run
|
|
ulimits:
|
|
nproc: 65535
|
|
nofile:
|
|
soft: 65535
|
|
hard: 65535
|
|
healthcheck:
|
|
test: ["CMD", "kubectl", "get", "--raw=/readyz"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 30
|
|
start_period: 30s
|
|
|
|
k3s-worker:
|
|
image: rancher/k3s:v1.36.2-k3s1
|
|
container_name: k3s-worker
|
|
command:
|
|
- agent
|
|
privileged: true
|
|
cgroup: host # kubelet в cgroup v2 (Ubuntu 22.04+/RedOS)
|
|
restart: unless-stopped
|
|
depends_on:
|
|
k3s-server:
|
|
condition: service_healthy
|
|
environment:
|
|
K3S_URL: https://k3s-server:6443
|
|
K3S_TOKEN: ${K3S_TOKEN:-supersecrettoken}
|
|
volumes:
|
|
- k3s-worker-data:/var/lib/rancher/k3s
|
|
tmpfs:
|
|
- /run
|
|
- /var/run
|
|
ulimits:
|
|
nproc: 65535
|
|
nofile:
|
|
soft: 65535
|
|
hard: 65535
|
|
|
|
gitea:
|
|
image: gitea/gitea:1.22
|
|
container_name: gitea
|
|
restart: unless-stopped
|
|
environment:
|
|
USER_UID: 1000
|
|
USER_GID: 1000
|
|
GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:-http://localhost:3000/}
|
|
GITEA__server__SSH_PORT: ${GITEA_SSH_PORT:-2222}
|
|
ports:
|
|
- "3000:3000" # web UI (80/443 заняты k3s)
|
|
- "${GITEA_SSH_PORT:-2222}:22" # git over ssh
|
|
volumes:
|
|
- ./gitea-data:/data:z # :z — SELinux label для RedOS
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "http://localhost:3000/api/healthz"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 12
|
|
start_period: 20s
|
|
|
|
volumes:
|
|
k3s-server-data:
|
|
k3s-worker-data:
|
|
gitea-data:
|