Kyle Isom
656f22e19b
The web UI connects to the vault API via gRPC using the Docker compose service name (e.g., "metacrypt:9443"), but the vault's TLS certificate has SANs for "crypt.metacircular.net" and "localhost". The new vault_sni config field overrides the TLS ServerName so certificate verification succeeds despite the hostname mismatch. Also updates metacrypt-rift.toml with vault_sni and temporarily binds the web UI port to 0.0.0.0 for direct access until mc-proxy is deployed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
36 lines
986 B
YAML
36 lines
986 B
YAML
services:
|
|
metacrypt:
|
|
build:
|
|
context: ../..
|
|
dockerfile: Dockerfile.api
|
|
container_name: metacrypt
|
|
restart: unless-stopped
|
|
# Run as root inside container — rootless podman maps this to the
|
|
# host user (kyle), so files in /srv/metacrypt/ are accessible.
|
|
user: "0:0"
|
|
ports:
|
|
- "127.0.0.1:18443:8443"
|
|
- "127.0.0.1:19443:9443"
|
|
volumes:
|
|
- /srv/metacrypt:/srv/metacrypt
|
|
healthcheck:
|
|
test: ["CMD", "metacrypt", "status", "--addr", "https://localhost:8443", "--ca-cert", "/srv/metacrypt/certs/ca.pem"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
metacrypt-web:
|
|
build:
|
|
context: ../..
|
|
dockerfile: Dockerfile.web
|
|
container_name: metacrypt-web
|
|
restart: unless-stopped
|
|
user: "0:0"
|
|
ports:
|
|
- "0.0.0.0:18080:8080" # TODO: revert to 127.0.0.1 once mc-proxy is deployed
|
|
volumes:
|
|
- /srv/metacrypt:/srv/metacrypt
|
|
depends_on:
|
|
- metacrypt
|