Added a view healthchecks

2023-06-09 08:58:54 +02:00 · 2023-06-09 08:58:54 +02:00 · 0520815da1
parent 063ff194e2
commit 0520815da1
8 changed files with 75 additions and 16 deletions
--- a/firefoxsync/docker-compose.yaml
+++ b/firefoxsync/docker-compose.yaml
@ -40,6 +40,10 @@ services:
    volumes:
      - ${VOLUMES_PATH}/firefoxsync/db:/var/lib/postgresql/data
    user: ${UID}:${GID}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
    labels:
      - "docker.group=firefoxsync"

--- a/git/docker-compose.yaml
+++ b/git/docker-compose.yaml
@ -11,18 +11,6 @@ services:
    networks:
      - web
      - git
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.forgejo.rule=Host(`gitea.${DOMAIN}`, `git.${DOMAIN}`)"
-      - "traefik.http.routers.forgejo.entrypoints=websecure"
-      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
-      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
-      - "traefik.http.routers.forgejo.middlewares=gitearedir"
-      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://gitea.${DOMAIN}/(.*)"
-      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://git.${DOMAIN}/$${1}"
-      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
-      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
-      - "docker.group=git"
    depends_on:
      - db
    restart: unless-stopped
@ -35,6 +23,22 @@ services:
      - DB_NAME=${POSTGRES_DB}
      - DB_USER=${POSTGRES_USER}
      - DB_PASSWD=${POSTGRES_PASSWORD}
+    healthcheck:
+      test: ["CMD", "curl" ,"--fail", "localhost:3000/api/healthz"]
+      interval: 5s
+      timeout: 3s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.forgejo.rule=Host(`gitea.${DOMAIN}`, `git.${DOMAIN}`)"
+      - "traefik.http.routers.forgejo.entrypoints=websecure"
+      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
+      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
+      - "traefik.http.routers.forgejo.middlewares=gitearedir"
+      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://gitea.${DOMAIN}/(.*)"
+      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://git.${DOMAIN}/$${1}"
+      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
+      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
+      - "docker.group=git"


  db:
@ -48,6 +52,10 @@ services:
      - git
    volumes:
      - ${VOLUMES_PATH}/git/forgejo_db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
    labels:
      - "docker.group=git"

--- a/monitoring/docker-compose.yaml
+++ b/monitoring/docker-compose.yaml
@ -47,6 +47,10 @@ services:
      - POSTGRES_DB=grafana
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
    labels:
      - "docker.group=monitoring"

--- a/nextcloud/docker-compose.yaml
+++ b/nextcloud/docker-compose.yaml
@ -11,6 +11,10 @@ services:
    networks:
      - web
      - nextcloud
+    healthcheck:
+      test: curl -sSf 'http://localhost/status.php' | grep '"installed":true' | grep '"maintenance":false' | grep '"needsDbUpgrade":false' || exit 1
+      interval: 5s
+      timeout: 3s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nextcloud.rule=Host(`cloud.${DOMAIN}`)"
@ -123,6 +127,7 @@ services:
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
+      - MARIADB_AUTO_UPGRADE=1
    logging:
      driver: "json-file"
      options:
@ -131,6 +136,10 @@ services:
    networks:
      - nextcloud
      - mariadb
+    healthcheck:
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
+      interval: 20s
+      timeout: 3s
    labels: 
      - "docker.group=netxtcloud"

@ -166,6 +175,10 @@ services:
      - monitoring
    volumes:
      - ${VOLUMES_PATH}/nextcloud/redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
    labels: 
      - "docker.group=netxtcloud"

--- a/nextcloud/nginx.conf
+++ b/nextcloud/nginx.conf
@ -22,6 +22,9 @@ http {
    sendfile        on;
    #tcp_nopush     on;

+    # Prevent nginx HTTP Server Detection
+    server_tokens   off;
+
    keepalive_timeout  65;

    #gzip  on;
@ -48,7 +51,7 @@ http {
        add_header X-Download-Options "noopen" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Permitted-Cross-Domain-Policies "none" always;
-        add_header X-Robots-Tag "none" always;
+        add_header X-Robots-Tag "noindex, nofollow" always;
        add_header X-XSS-Protection "1; mode=block" always;

        # Remove X-Powered-By, which is an information leak
--- a/proxy/docker-compose.yaml
+++ b/proxy/docker-compose.yaml
@ -18,6 +18,7 @@ services:
      #- "--log.level=DEBUG"
      - "--log.level=INFO"
      #- "--accesslog=true"
+      - "--ping=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
@ -42,6 +43,10 @@ services:
    volumes:
      - ${VOLUMES_PATH}/proxy/letsencrypt:/letsencrypt
      - $PWD/tls.toml:/etc/traefik/tls.toml
+    healthcheck:
+      test: traefik healthcheck --ping
+      interval: 3s
+      timeout: 1s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.${DOMAIN}`)"
@ -63,14 +68,18 @@ services:
    environment:
      # grant privileges as environment variables: https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections
      - CONTAINERS=1
-      - INFO=1      
+      - INFO=1
    networks:
      - dockersocket
+    healthcheck:
+      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"]
+      interval: 10s
+      timeout: 3s
    privileged: true


  whoami:
-    image: containous/whoami
+    image: traefik/whoami
    networks:
      - web
    labels:
--- a/wallabag/docker-compose.yaml
+++ b/wallabag/docker-compose.yaml
@ -21,6 +21,10 @@ services:
      - wallabag
    volumes:
      - /var/dockervolumes/wallabag/images:/var/www/wallabag/web/assets/images
+    healthcheck:
+      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost"]
+      interval: 10s
+      timeout: 3s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wallabag.rule=Host(`wallabag.${DOMAIN}`)"
@ -41,14 +45,24 @@ services:
      - wallabag
    volumes:
      - /var/dockervolumes/wallabag/db:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
+      interval: 10s
+      timeout: 3s
    labels:
      - "docker.group=wallabag"
  
  redis:
-    image: redis:alpine
+    image: redis
    restart: unless-stopped
    networks:
      - wallabag
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+    labels:
+      - "docker.group=wallabag"


 networks:
--- a/www/docker-compose.yaml
+++ b/www/docker-compose.yaml
@ -7,6 +7,10 @@ services:
    networks:
      - web
    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl" ,"--fail", "localhost"]
+      interval: 5s
+      timeout: 3s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS