maxwayne/patch-review-compose:1.13

# Patch Review - Docker Compose application
#
# This file is published to Docker Hub as an OCI artifact by
# scripts/publish.sh, which replaces docker.io/maxwayne and 1.13 first.
# Install it on any Docker host (Compose 2.34 or later) with:
#
#   docker compose --env-file patch-review.env \
#     -f oci://docker.io/<namespace>/patch-review-compose:<version> up -d
#
# Every setting comes from patch-review.env on the host (example:
# deploy/patch-review.env.example). There are no bind mounts, because
# Docker will not publish a Compose file that has them: the data and the
# page live in two named Docker volumes.
#
#   patch-review      builds the page every RUN_INTERVAL_SECONDS and the
#                     live status (status.json) every STATUS_INTERVAL_SECONDS
#   patch-review-web  serves the page on PATCH_REVIEW_WEB_PORT (default 8088)
#                     and passes button presses to EDA

name: patch-review

services:
  patch-review:
    image: docker.io/maxwayne/patch-review:1.13
    container_name: patch-review
    restart: unless-stopped
    init: true
    environment:
      TZ: ${TZ:-America/Toronto}
      # How often things run
      RUN_INTERVAL_SECONDS: ${RUN_INTERVAL_SECONDS:-3600}
      STATUS_INTERVAL_SECONDS: ${STATUS_INTERVAL_SECONDS:-120}
      RETRY_SECONDS: ${RETRY_SECONDS:-900}
      CHECK_SECONDS: ${CHECK_SECONDS:-5}
      # Where the package data comes from
      PATCH_REVIEW_SOURCE: ${PATCH_REVIEW_SOURCE:-prometheus}
      PROMETHEUS_URL: ${PROMETHEUS_URL:-}
      STALE_AFTER_HOURS: ${STALE_AFTER_HOURS:-24}
      MACHINE_GROUPS: ${MACHINE_GROUPS:-}
      DEBIAN_ORIGINS: ${DEBIAN_ORIGINS:-Debian}
      PROXMOX_ORIGINS: ${PROXMOX_ORIGINS:-Proxmox}
      COMPARE_WITH_UYUNI: ${COMPARE_WITH_UYUNI:-false}
      # Proxmox API (read-only token for package changelogs)
      PROXMOX_TOKEN_ID: ${PROXMOX_TOKEN_ID:-patch-review@pve!page}
      PROXMOX_TOKEN_SECRET: ${PROXMOX_TOKEN_SECRET:-}
      PROXMOX_NODE_TOKEN_SECRETS: ${PROXMOX_NODE_TOKEN_SECRETS:-}
      PROXMOX_DOMAIN: ${PROXMOX_DOMAIN:-}
      PROXMOX_VERIFY_TLS: ${PROXMOX_VERIFY_TLS:-true}
      # Uyuni (only for PATCH_REVIEW_SOURCE=uyuni or COMPARE_WITH_UYUNI=true)
      UYUNI_URL: ${UYUNI_URL:-}
      UYUNI_USERNAME: ${UYUNI_USERNAME:-patch-review}
      UYUNI_PASSWORD: ${UYUNI_PASSWORD:-}
      UYUNI_CA_URL: ${UYUNI_CA_URL:-}
      UYUNI_CA_CHECKSUM: ${UYUNI_CA_CHECKSUM:-}
      UYUNI_VERIFY_TLS: ${UYUNI_VERIFY_TLS:-true}
      # CVE lookups
      NVD_API_KEY: ${NVD_API_KEY:-}
      # Buttons: on when EDA_ACTION_TOKEN is set. The token itself stays in
      # the web container; this container only learns "true" or "".
      EDA_ENABLED: ${EDA_ACTION_TOKEN:+true}
      OPEN_LINK_URL: ${OPEN_LINK_URL:-}
      # Maintenance tab: window names from eda_patch_windows in eda-patching
      WINDOW_VM: ${WINDOW_VM:-vm}
      WINDOW_PHYSICAL: ${WINDOW_PHYSICAL:-proxmox}
      # Page
      PAGE_TITLE: ${PAGE_TITLE:-Patch Review}
      PATCH_NOW_DAYS: ${PATCH_NOW_DAYS:-3}
      PATCH_SOON_DAYS: ${PATCH_SOON_DAYS:-14}
      CAN_WAIT_DAYS: ${CAN_WAIT_DAYS:-30}
    volumes:
      - data:/data            # CVE cache, indexes, Uyuni CA (owned by UID 10001)
      - output:/output        # the page (owned by UID 10001)
    read_only: true
    tmpfs:
      - /tmp                  # config.ini is written here at every start
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

  web:
    image: docker.io/maxwayne/patch-review-web:1.13
    container_name: patch-review-web
    restart: unless-stopped
    environment:
      TZ: ${TZ:-America/Toronto}
      EDA_ACTION_URL: ${EDA_ACTION_URL:-}
      EDA_ACTION_TOKEN: ${EDA_ACTION_TOKEN:-}
      EDA_VALIDATE_CERTS: ${EDA_VALIDATE_CERTS:-true}
    ports:
      # Long form: 'docker compose publish' reads the file before the
      # ${...} values are filled in, and refuses the short "8088:80" form then.
      - target: 80
        published: "${PATCH_REVIEW_WEB_PORT:-8088}"
        protocol: tcp
    volumes:
      # Read only, and "nocopy" so nginx never puts its own files into the
      # volume: the patch-review container owns it.
      - type: volume
        source: output
        target: /usr/share/nginx/html
        read_only: true
        volume:
          nocopy: true
    depends_on:
      - patch-review

volumes:
  data:
  output: