status-im
/
infra-role-beacon-node
mirror of https://github.com/status-im/infra-role-beacon-node.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

mount secrets subfolder as read-only volume to protect them 

Signed-off-by: Jakub Sokołowski <jakub@status.im>
This commit is contained in:
Jakub Sokołowski 2020-11-30 17:35:31 +01:00
parent fbfb216910
commit e48761352b
No known key found for this signature in database
GPG Key ID: 4EF064D0E6D63020
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
defaults/main.yml
View File

@ -11,6 +11,9 @@ beacon_node_cont_vol: '/docker/{{ beacon_node_cont_name }}'
beacon_node_cont_entrypoint: '/usr/local/bin/nimbus_beacon_node' beacon_node_cont_entrypoint: '/usr/local/bin/nimbus_beacon_node'
beacon_node_cont_update_enabled: true beacon_node_cont_update_enabled: true
# Subfolders for separate read-only mounting
beacon_node_secrets_path: '{{ beacon_node_cont_vol }}/data/{{ beacon_node_data_folder }}/secrets'
# connectivity settings # connectivity settings
beacon_node_discovery_port: 9000 beacon_node_discovery_port: 9000
beacon_node_listening_port: 9000 beacon_node_listening_port: 9000

8
tasks/compose.yml
View File

@ -6,6 +6,9 @@
owner: dockremap owner: dockremap
group: docker group: docker
mode: 0750 mode: 0750
with_items:
- '{{ beacon_node_cont_vol }}/data'
- '{{ beacon_node_secrets_path }}'
- name: Verify network name - name: Verify network name
assert: assert:
@ -31,6 +34,9 @@
- '{{ beacon_node_listening_port }}:{{ beacon_node_listening_port }}/tcp' - '{{ beacon_node_listening_port }}:{{ beacon_node_listening_port }}/tcp'
- '{{ beacon_node_discovery_port }}:{{ beacon_node_discovery_port }}/udp' - '{{ beacon_node_discovery_port }}:{{ beacon_node_discovery_port }}/udp'
entrypoint: '{{ beacon_node_cont_entrypoint }}' entrypoint: '{{ beacon_node_cont_entrypoint }}'
volumes:
- '{{ beacon_node_cont_vol }}/data:/data'
- '{{ beacon_node_secrets_path }}:/data/{{ beacon_node_data_folder }}/secrets:ro'
command: >- command: >-
--network={{ beacon_node_network }} --network={{ beacon_node_network }}
--data-dir='/data/{{ beacon_node_data_folder }}' --data-dir='/data/{{ beacon_node_data_folder }}'
@ -47,5 +53,3 @@
--metrics --metrics
--metrics-address=0.0.0.0 --metrics-address=0.0.0.0
--metrics-port={{ beacon_node_metrics_port }} --metrics-port={{ beacon_node_metrics_port }}
volumes:
- '{{ beacon_node_cont_vol }}/data:/data'